Header image  
private investigators specializing in the forensic imaging and analysis of digital media  
    HOME   |  
What NOT to do in an urgent situation
  • If you can't access your files:

    No matter how urgently you need those documents, do NOT disassemble the hard drive!  If you had the necessary equipment and the skills, you wouldn't be looking here. 

    If you're sure it's a hardware failure (drive is too hot to touch, it's making unusually crunchy sounds, etc), you'll save time and money in the long run by contacting a reputable data recovery company as soon as possible.  We've used Kroll Ontrack in the past and will in the future. 

    If you've lost access to your files because of malware or other software/operating system problems, we can probably help you.  Give us a call.


  • If you're just been served with a subpoena, preservation letter, or other civil process for your system(s):

    Resist the impulse to go in and see what they are talking about.  Do NOT start clicking around to see if you are in trouble (or how much trouble you are in) and absolutely do not try to delete, hide, or encrypt files.  Any tampering will be evident and the court is apt to give the jury an "adverse inference" instruction (that is, they are to assume that the missing material held evidence of guilt).

    DO contact your attorney, particularly if this is a business system.  If your attorney is not familiar with "electronic discovery" and the documents you were served with do not contain preservation instructions, have your attorney contact us.  If this is the first time your computer technical support person has dealt with electronic discovery and is wise, he or she will ask for help.  Call us.


  • If you are served with a search warrant:

    Do NOT obstruct the police.

    If you think that what they are doing is illegal, unauthorized, or unfair, let your lawyer deal with it in court.  Now is not the time to argue or resist - you will probably go to jail (or worse) if you do.  If you need legal advice, call an attorney - NOT this agency or anyone other than an attorney.  (While we do not do criminal defense examinations, we are willing to answer your attorney's technical questions and we will undertake examinations as a neutral party working on behalf of the court.)

  • If you believe your system has been used for criminal purposes or holds data that may become evidence in a civil or criminal matter:

    Do NOT try to find the evidence yourself.  Doing so will change time and date entries making it far more difficult to determine who did what when, and you may even render information vital to your position inadmissible.  (Note that technical support personnel are not normally trained in the recognition and handling of evidence, and during a crisis is not the time for them to learn.  If you want to get training in this area for your in-house tech support person we can help, but call before there's a problem.)

    DO call us as soon as you realize you have a problem.