What is civil litigation computer forensics?
Civil litigation computer forensics involves the forensic acquisition, preservation and analysis of digital evidence for use in civil proceedings. This includes employment disputes, intellectual property theft, shareholder conflicts, contract breaches and fraud investigations. Civil matters operate under the balance of probabilities standard and follow BC Supreme Court Civil Rules for disclosure.
Can deleted files be recovered for use in civil litigation?
In many cases, yes. Deleted files may persist in unallocated disk space, file system journals, Volume Shadow Copies, cloud backups and application caches. Success depends on whether the storage area has been overwritten. Our examiners use forensic tools to recover deleted data and authenticate it for court use.
How is computer forensics used in employment disputes?
Forensic analysis can reveal unauthorized data access, confidential file transfers to personal devices, deletion of company records, use of company resources for competing business and policy violations. We recover deleted files, analyze USB device history, examine cloud sync activity and construct timelines of employee conduct.
What is a forensic preservation order and when should counsel seek one?
A forensic preservation order compels a party to preserve digital evidence when there is risk of evidence spoliation. You should seek one when an employee is suspected of deleting files before departure or when a party may destroy relevant records. Sherlock Forensics assists counsel with the technical affidavit supporting such applications.
Does Sherlock Forensics work with both plaintiff and defence counsel?
Yes. We provide impartial forensic analysis for both plaintiffs and defendants. Our reports present factual findings based on digital evidence without advocacy for either side. This objectivity strengthens the credibility of our findings and expert testimony in court.