Our work portfolio includes very large and complex projects as well as the small and simple. The case studies below demonstrate how law firms and corporations are leveraging our expertise and great customer service.

Computer Forensics Case Studies

The Challenge

Attorneys of one of nation’s largest aviation ground support equipment manufacturers contacted us for help. About a year earlier, their client had received a discovery request and had chosen to buy an off-the-shelf e-Discovery software. They had performed a self-collection and produced documents that they found to be responsive. They thought all was well until opposing counsel got their hands on game changing documents that were apparently missed during the production.

They were ordered to engage an expert. The production had to be re-done within two weeks and had to be done right. Approximately 12 TB of data from servers and workstations had to be collected and searched. There was no room for error.

Potential Issues

  • We had to collect data from critical servers such as an Ms Exchange server and several file servers and the company did not have any tolerance for down time
  • A large volume of the data consisted of non-searchable PDFs and images that had to be OCR’ed and made searchable before culling
  • All of the servers used multi-disk storage systems such as RAID arrays. Multi-disk systems have to be acquired with caution and reconstructed
  • In addition to the servers and workstations, we were given 56 DVDs which contained back-ups of the custodian workstations
  • Everything was now under scrutiny because of the incomplete first production. Electronic documents and e-mails deleted from each computer or server had to be analyzed and reported

Our Solution

A project of this scale requires serious planning and project management. We assisted our client in adjusting their search terms and methodology to be able to hone in on the results as quickly and accurately as possible. Our search engine automatically OCR’ed all documents without extractable text before the search was performed. This ensured that every document was searched regardless of whether or not it contained extractable text.

We mapped the company’s computer network and identified all data sources relevant to the matter. Their IT team provided us with a pivot computer which we could remotely connect to and use to manage the enterprise collection.

We used utilization metrics to determine the best time frames to access and collect data from each server. Our experts connected to the pivot computer and collected data from each device at the scheduled time slots. This allowed us to perform the forensic data collection during off hours and the weekend without disrupting the company’s business activities. Images were stored on encrypted external hard drives and retrieved as each drive was filled.

While the acquisition was in progress, we made an inventory of the back-up DVDs and started indexing them. Forensic analysis was performed and reports were written in parallel while the searching and processing was taking place. Search results and reports were delivered on a rolling basis according to scheduled delivery deadlines.

Results

  • 12 TB of data was collected and searched -including images and PDFs without extractable text- without disrupting the company’s business
  • Exchange Server data and logs were extracted and analyzed
  • Our digital forensics team identified deleted electronic documents and e-mails from each workstation and server
  • The entire data set was processed on schedule, in under 2 weeks
  • We were able to complete the project within budget and without any surprises thanks to our predictable pricing
  • Our client made the tight deadline without breaking a sweat

Case Facts:

  • 12 TB of data from servers and workstations
  • Lots of non-searchable file types that most e-Discovery software would miss
  • Multi-disk storage arrays
  • Client’s business cannot be interrupted
  • Less than 2 weeks to locate and process responsive documents
e-Discovery Case Studies

The Challenge

Our law firm client came to us with data dumps they received from a cellular provider. Their discovery agreement with opposing counsel required them to produce the data dumps as individual documents in TIFF format with extracted text and metadata. Unfortunately, it was too late to change the production format and the deadline was approaching rapidly.

The cellular data format was large, comma separated text files with 84 fields. The data files contained a total of approximately 33 million records, which equated to 33 million documents to be produced. We had to convert each record to its own document, extract text and metadata, and produce TIFF images endorsed with a confidentiality designation and bates number. To add insult to injury, nine copies of the deliverable had to be made for the parties involved.

Potential Issues

  • This was a page count nightmare. Converting each document to 84 lines of text resulted in 2-page documents, which meant we had to produce 66 million pages
  • Time was definitely not on our side. Our client had to have the hard drives in hand within 72 hours
  • Nine copies of the deliverable had to be made

Our Solution

We quickly realized that this could not be accomplished via regular e-Discovery processing. While we could easily convert each record to its own document, running 33 million documents through our e-Discovery process would be very time consuming. Each document would have to be ingested, converted to TIFF and endorsed during the export.

Our solution was to develop a custom software application that did the following:

  • Parsed each record’s fields and prepared a neat, multi-column, single-page report. This reduced the page count from 66 million to 33 million!
  • Saved the report in plain text format
  • Rendered the report directly to an endorsed TIFF without running it through a TIFF print driver (unbelievable throughput)
  • Output a metadata load file populated with fielded cellular metadata and an image reference file

We ran this process in parallel on several workstations. Thanks to our high-speed network storage system, disk I/O did not become a huge bottleneck and we were able to create the 33 million endorsed pages lightning fast.

Results

  • The production was a success. 33 million documents were produced according to specs in under 48 hours
  • We were able to offer our client a very competitive rate since we utilize our own tools for processing (no royalties)
  • We received a lot of compliments on how beautiful the produced documents looked. Who would have thought that those ugly CSV files could be turned into intuitive reports that were easy on the eyes?
  • Our client made the deadline while maintaining their low stress levels and we enjoyed the satisfaction of making another client happy

Case Facts:

  • 33 million documents
  • Each page had to be endorsed
  • Text had to be extracted from each document
  • Nine copies of the deliverable had to be made
  • Less than 72 hours to deliver the production
Time card e-Discovery

The Challenge

Obtaining the electronic evidence to make your case means you’ve won your first battle. But, what if you are given a bunch of unstructured data that you cannot make any sense of? That was the case for one of our clients in a construction labor dispute case when opposing counsel produced thousands of scanned time cards along with an electronic export from their client’s proprietary project management system.

The time cards were in numerous layouts with different fields. Most contained hardly legible handwriting, arithmetic errors and abbreviated names and last names. Our client’s goal was to compare the time cards to the electronic project management and accounting records and determine whether or not there were any discrepancies. The problem was that, performing this kind of analyses on scanned images of unstructured time cards would take weeks and be prohibitively costly.

Potential Issues

  • Time card format was not consistent. Some were typed, some were handwritten
  • Most of the time cards contained labor records for other, unrelated construction projects. These needed to be weeded out
  • The daily and weekly totals on some of the time cards were incorrect
  • Overtime had to be calculated for each employee
  • Some of the time cards were only partially legible

Our Solution

It became clear to us quickly that we had to capture all relevant information from each time card and store it in a database. We could then provide access to the data via a graphical user interface (GUI) so that our client could review individual records, query the data, prepare reports etc. This would also make it easier for us to perform the complex investigative tasks that our client required.

We whipped up a SQL based data capture software prototype. It was designed to do the following:

  • Display the image associated with each time card for data capture
  • Provide a custodian lookup feature for accurate capture of custodian names and numbers. For example, typing 83 would automatically populate the custodian field with the full name of custodian #83. If the number was not available, the analyst could start typing the name to do a reverse lookup
  • Automatically calculate daily and weekly totals as well as overtime
  • Provide flags to facilitate the capture of additional pertinent data such as whether or not the time card was signed by a supervisor
  • Automatically populate the date of each daily entry based on the entered week ending date

Capturing so much information was not only tedious, but also very error prone. Our software design was foolproof and supported our analysts with numerous automated checks. The user interface we made ended up being so intuitive that it was almost fun to do the data capture. All the time cards were coded in no time and rigorous quality control helped make sure the captured data was 100% accurate.

When we delivered the electronic version of the time cards, our client was ecstatic. They analyzed the data in depth using both Microsoft Excel and our GUI. Additionally, they tasked us to help them perform some of the more complex analyses. We found tons of discrepancies and put them all in a neat and detailed report.

Results

  • Thousands of unstructured time cards were converted into a relational database that could be queried
  • Our client saved weeks of time and had the opportunity to query the data as they wished
  • Our report brought up appalling discrepancies that completely threw the opposing counsel off their game
  • We helped our client present their case very strongly and elegantly. They won a favorable judgment
  • The total project cost was only a fraction of what it would have been without the software we developed

Case Facts:

  • Thousands of unstructured time cards
  • Complex analysis must be done in a timely manner to find discrepancies
  • Partially legible and occasionally inaccurate records
  • Lots of additional information to be captured such as overtime and supervisor signatures