Digital Forensics and Cybersecurity Common Questions: What Lawyers Should Know

Production & Anton Piller Orders

The world has already seen an increase in cybersecurity attacks and crimes due to COVID-19. Lawyers must be prepared to handle the increase in digital forensics and cybersecurity cases coming their way that will require extensive expertise in all things digital.

TCS Forensics is proud to have a proven track record in helping achieve successful legal resolutions for our clients. Check out the types of clients and cases we have worked with here.

Over the years, we have worked closely with lawyers and covered cases in criminal law, family law, employment law, intellectual property, estate litigation, and more. We decided to put together a list of the top questions we get from lawyers to help you in your research:

1. “What sources can we collect data from?”

There are lots of sources. In fact, any device that can be connected to the network, is connected— a term known as internet of things (IoT)— and should be assessed. Having a broad collection of sources is important because data can be extracted from phones all the way to smart fridges.

You can find our cheat sheet of data sources here.

2. “Do I need e-discovery or digital forensics?”

This is a common question we get and there is often confusion between the two terms. E-discovery is meant to search through large amounts of data, but it can’t find the data nor figure out what happened. Digital forensics on the other hand is able to uncover, interpret, and analyze data. It can find deleted or hidden files as well as explains the traces. For cases that require you to gather and interpret evidence, digital forensics is the service you need.

Here is a cheat sheet you can refer to that compares digital forensics and e-discovery.

3. “Can you get data from a smart phone that is locked?”

Yes, it’s possible. There are some smart phones that allow data to be extracted if it is locked. There are also some Android smart phones and iPhones that can be cracked and decrypted to make the data readable.

4. “Can digital forensics help to prove when a file was created and last used?”

 Yes, digital forensics is able to extract and examine data from a plethora of electronic devices. There is a 5-step procedure and an important step in the process is the metadata analysis which helps determine when a file was originally created and the first time it enters a system or was accessed.

5. “Can you get data from a MacBook if it is password protected?”

 Currently, we do not support extraction of data from password protected MacBooks since their encryption is strong. Hopefully, this will change in the near future.

6. “What kind of data can you get from cloud sources?”

 Cloud sources allow you to store and access data on programs that can be used with the internet such as iCloud and Google Drive. Cloud sources host phone backups, instant message backups, emails, location data, voice searches, call logs, social media accounts, virtual machines and so much more. There are all sorts of data types, but the credentials are necessary in order to proceed.

Article written by:

Farah Khan,

Writer, Multimedia Content Creator & Digital Marketing Specialist