Computer forensic examiners are from Mars, attorneys are from Venus

The outcome of high stakes investigations and litigation can often depend on the evidence uncovered through computer forensic investigation. That fact highlights the critical nature of the forensic examiner-attorney relationship at the heart of forensic investigation.

Computer forensic investigations are critical to an enterprise’s response to a wide range of issues faced today, from a departing employee’s theft of proprietary information, to hostile workplace and employment claims, or responses to security breaches.

Ultimately, in all of these situations, the enterprise’s interests boil down to how, or whether, to pursue its rights or defend itself in a legal context. By necessity, a forensic examiner and an attorney will (or should) be working closely together in pursuit of the enterprise’s best interests.

After nearly fifteen years as a prosecutor and litigator, and now computer forensics consultant, I’ve seen and heard enough avoidable examiner-attorney relationship breakdowns to be in a position to offer a bit of counseling in identifying some of the most commonly occurring relationship killers, as well as a little practical advice for avoiding them.

In addition, I also reached out to some of the top flight litigators who we often work with and polled them on what was the first thing that came to mind regarding a frustration experienced when working with a computer forensics consultant. Their answers were illuminating, and many common frustrations were shared by several of the litigators.

Interestingly, many of the common frustrations have more to do with poor communication and a lack of care and nurturing of the examiner-attorney relationship, than with the technical competency of the examiner or her work.

Before there’s even an engagement, embrace your purpose in life
It’s not about you! If you want to ensure not only a successful engagement or investigation but also a successful career, recognize that your purpose is to make whoever has brought you to the dance look good – nothing more, nothing less.

A courtroom supervising prosecutor in the county where I started my career used to tell his second and third chair prosecutors that their job was to make him look good. For those who succeeded at their “jobs,” he made sure their careers flourished. Not so much for those who didn’t get with the program.

Apply this mindset to every aspect of your forensic work, and I guarantee that you will have greater professional success than you ever imagined. Several specific examples of how this mindset is applied will follow.

In short, I implore you to approach every aspect of your work by asking yourself two simple questions- How can I make my attorney look good?, and its corollary, How can I make the examiner’s life easier?

Getting it right from the start is critical
The very first stages of an investigation offer critical opportunities for forming a strong working relationship with counsel and establishing a strong foundation upon which a successful investigation can be built. Failure to take advantage of these opportunities will almost assuredly spell disaster and much heartache.

By understanding the essential facts of a case, as well as the legal objectives of the investigation or litigation, an examiner is able to become a strategic partner with counsel rather than just blindly digging out ones and zeroes in a vacuum.

Not only will this contribute to designing a focused, cost-effective examination plan, but the examiner will also understand how her work fits within counsel’s strategies, ensuring that critical evidence isn’t overlooked and allowing for more persuasive work product tailored to counsel’s needs. (How can I make him look good?)

In addition, it also provides an opportunity for the examiner to identify and suggest possibilities in which the digital evidence may yield benefits in the case beyond what counsel was initially envisioning.

It is fairly common for counsel to call us with a very limited purpose in mind with respect to how the digital evidence might be of benefit in their case. They are not aware of the ins and outs of computer forensics and the potential nuggets of gold that may lie within the digital evidence, and where else they may benefit their case.

In learning the facts and legal objectives in play, you will often be able to identify other possibilities for how the digital evidence could be helpful that counsel had not even considered. In the process you will be making yourself a valuable partner and making him look good!

Sergio Acosta, former Chief of the General Crimes Section of the U.S. Attorney’s Office in Chicago, and current Hinshaw and Culbertson partner, shared his take on what works best here, “I’d say expressing a genuine interest in the facts and nature of the case is a big positive. As a former prosecutor, I still have that investigative team mentality. I have been most impressed with forensic examiners who exhibit a teamwork attitude and approach…”

Project planning: A clear, focused, yet thorough plan with reliable time and cost expectation
You must take the lead in identifying how, through your examination and investigation, you can help counsel in taking on the issues that they are facing. In most instances, you cannot just passively sit back and leave counsel to try to design and direct your work.

Very few attorneys know enough about the possibilities and limitations of computer forensics. That’s why they’ve called you! Here again is a golden opportunity to make them look good by listening to the facts and strategies of their case, and offering a thorough, yet focused, forensic investigation plan.

Equally important to clearly explaining what you may be able to do and how you will pursue that, you must also be prepared to be clear on what you cannot do, including possibly dissuading erroneous notions counsel may have about the secret powers of computer forensics.

A very common refrain from the panel of litigators was dissatisfaction in how examiners handled this aspect of their engagement. Either the examiners didn’t think broadly enough in terms of how they could be of help, or they oversold what they could do.

All expressed great appreciation for the examiner who jumped in and quickly mapped out a clear examination plan and objectives tailored to their facts and strategies.

Equally appreciated was the examiner who considered the challenges presented by an attorney’s quirky situation and, rather than throwing up her hands and giving up, figured out an effective work-around-¦ at a reasonable cost!

Time is of the essence
Iain Johnston, co-founding partner of Johnston & Greene in Chicago, handles very sensitive, high profile investigations and litigation where the financial stakes can be high, and individuals’ careers can hang in the balance.

His response pretty well captures the urgency of the situation, “When the stuff hits the fan, I’m reaching out to a computer forensics consultant for a reason; i.e., there is a crisis. So I need the consultant to be very responsive.”

Tension is often high and nerves on edge during this initial period of uncertainty where counsel and client don’t yet have a handle on the situation, let alone how they’re going to come out on the other side of it.

You MUST be hyper-responsive, if not proactive wherever possible. Once you are
“at the scene,” you need to help bring sense and order to the situation for counsel and his client by quickly assessing the situation and providing a clear and concise roadmap for tackling the digital issues at hand.

Also, the importance of timeliness and of an appropriate sense of urgency doesn’t dissipate once the initial crisis situation has passed. Whether driven by investigative or litigation demands, critical deadlines will continue to present themselves. The last thing counsel needs is to add uncertainty about whether the examiner will complete her work on time to his list of pressures. Once again: How can you make him look good and his life easier?

Communications must be clear and concise, no techno-babble
By far, the most commonly voiced frustration by my panel of attorneys was examiners who use techno terminology and jargon that only Bill Gates could love. Stop it!

Michael Elkon, a Fisher & Phillips litigator in Atlanta, paid an examiner with whom he worked the highest of compliments for her ability to put technology in laymen’s terms, “An examiner gave me a great explanation as to what you can and cannot tell from a file registry that I still use at least once a month when talking to clients, and I end up sounding smarter to my clients. I would have a harder time doing my job without being able to explain to clients what the registry can show with respect to thumb drive usage.”

Before speaking with counsel, or writing a report or affidavit to be shared with counsel, you MUST step back and check that you are communicating in a way that the common man on the street could understand. Where a technical term must be used, consider including a definition or explanation of the term. To explain technical processes, consider analogies to non-technical, everyday experiences with which others would already be familiar.

A “data dump” does not a “report” make
For Mike Wexler, a Seyfarth Shaw litigator, the first frustration that came to his mind was “Information that is not user friendly and doesn’t answer basic fundamental issues-¦we receive big printouts that are not boiled down in any way and are too technical.”

Wexler’s lament has been repeated by many of the polled litigators. This is right at the heart of the “How can I make the attorney look good? How can I make the examiner’s life easier?” mindset.

First, while some of the “extraneous” data in a report or spreadsheet that you produce may mean something or may even be critical to you, counsel may not care one iota about it. It only creates confusion and adds to the crushing volume of data through which counsel must wade through to get to what he actually needs.

Get rid of all the non-essential fields, columns, rows, records, non-user created files, and other unimportant things! Take the time to think through what’s truly going to be useful and meaningful to counsel, and cut out all the rest. Then, create a template for yourself and continually improve upon it so the next client, and the next client, and the next reap the benefits of your work.

Similarly, give some thought to how you identify and label items. For example, rather than having a spreadsheet with tabs labeled “LT1,” LT2,” LTn,” why not label them “Jones LT,” “Smith LT,” “Thomas LT”? Whatever fits, but the point is to identify and label things in such a way as to make it as easy as possible for counsel to immediately know to what it refers. (How can I make his life easier?)

Silence is golden
Silence kills. Nothing is more frustrating to counsel than not knowing what’s going on with your examination. What’s been completed? What’s your initial sense of the situation (understanding it’s preliminary and subject to change)? What are the next steps? When do you expect they’ll be done? Are you hitting any snags? Should we be considering any other avenues? Where are we at on costs?

These are all critical questions, the answers to which counsel should never be left wondering about. And don’t leave counsel to have to chase after you for the information. Take the lead and send, or call, with a regular update. Not only is counsel interested in knowing, but you can also be sure that his client is calling him asking the exact same questions. Once again: How can I make his life easier and make him look good?

No surprises when the inevitable mistakes occur
None of us are perfect. Mistakes sometimes happen, and your better lawyers understand that and calmly and deftly manage through them when they occur.

But, as too many a politician can tell you, it’s often not the crime, but the cover-up that caused the serious damage and fall-out. And so it was for a member of my litigators panel who’s in his firm’s national eDiscovery and Information Governance practice group and was incensed when, to add injury to the insult of losing several forensic images, his vendor not only failed to timely inform him of the mess up, but actually tried to cover it up by “re-creating” the images and presenting them as the originals. You can imagine his opinion of that vendor today.

Mistakes happen. It’s never any fun to have to tell on yourself, but nothing will put you in more hot water, and do more damage to your practice, than failing to timely and forthrightly inform counsel of the mistake. Naturally, verify that there truly is an issue, and take a moment to identify possible solutions, but make that call (not an email!) sooner than later.

May you enjoy a long and prosperous career
Despite their incredibly busy, demanding schedules, my superstar panel of litigators quickly responded to my request for feedback, even forwarding it to others in their firms who also provided feedback. Clearly, all have had experiences with computer forensics examiners that have left something to be desired.

The great news is that it’s obviously of great interest to them to contribute to improving these working relationships, and they’re looking for the right examiners with whom to build those relationships.

For you, there’s great reason for optimism. None of the items discussed above are particularly difficult to master. Most of it is the kind of basic life principles that you learned in kindergarten. Simply consistently thinking in terms of “How can I make his life easier? How can I make him look good?” as you go about your work will ensure you a long and prosperous career.