|What NOT to do in an urgent situation
- If you can't access your files:
No matter how urgently you need those documents, do NOT disassemble the hard drive! If you had the necessary equipment and the skills, you wouldn't be looking here.
If you're sure it's a hardware failure (drive is
too hot to touch, it's making unusually crunchy sounds, etc), you'll
save time and money in the long run by contacting a reputable data
recovery company as soon as possible. We've used Kroll Ontrack in the past and will in the future.
If you've lost
access to your files because of malware or other software/operating
system problems, we can probably help you. Give us a call.
- If you're just been served with a subpoena, preservation letter, or other civil process for your system(s):
Resist the impulse to go in and see what they are talking about. Do NOT start clicking around to see if you are in trouble (or how much trouble you are in) and absolutely do not try to delete, hide, or encrypt files.
Any tampering will be evident and the court is apt to give the jury an
"adverse inference" instruction (that is, they are to assume that the
missing material held evidence of guilt).
contact your attorney, particularly if this is a business system.
If your attorney is not familiar with "electronic discovery" and the
documents you were served with do not contain preservation
instructions, have your attorney contact us. If this is the first
time your computer technical support person has dealt with electronic
discovery and is wise, he or she will ask for help. Call us.
- If you are served with a search warrant:
Do NOT obstruct the police.
think that what they are doing is illegal, unauthorized, or unfair, let your lawyer deal with it in
court. Now is not the time to argue or resist - you will probably
go to jail (or worse) if you do. If you need legal advice, call an attorney - NOT
this agency or anyone other than an attorney. (While we do
not do criminal defense examinations, we are willing to answer your
attorney's technical questions and we will undertake examinations as a
neutral party working on behalf of the court.)
- If you believe your system has been
used for criminal purposes or holds data that may become evidence in a
civil or criminal matter:
try to find the evidence yourself. Doing so will change time and
date entries making it far more difficult to determine who did what
when, and you may even render information vital to your position
inadmissible. (Note that technical support personnel are not
normally trained in the recognition and handling of evidence, and
during a crisis is not the time for them to learn. If you want to
get training in this area for your in-house tech support person we
can help, but call before there's a problem.)
DO call us as soon as you realize you have a problem.