Forensic Technologies Solutions

• You need to preserve evidence on employees' or other parties' computers, servers, backup tapes or PDAs – often without the potential perpetrators knowing about it
• You need to identify password protected, encrypted, hidden or deleted documents – without damaging or altering the data or taking the organisation's server network out of action
• You need to be able to search and review a large volume of e-mails and other documents from multiple sources and to categorise these documents depending on their relevance
• You need to trace transactions or patterns of transactions hidden within huge volumes of data, efficiently and without taking financial systems offline for extended periods of time.
• You need to review and categorise paper records (such as correspondence file statements and invoices from accounting data)

PricewaterhouseCoopers’ (PwC) forensic technology solutions team is one of the forensic services group’s key differentiator’s in the market place. The combination of technologists working in concert with accountants and finance professionals provides the group with the ability to provide unique approaches to complex business dispute and investigative matters. Honed by years of experience, we combine data analysis techniques, proprietary information technology tools, information management principles, and our understanding of the unusual environment created by investigative and dispute matters to help our clients make informed decisions.

Our experienced professionals obtain and analyze data detail using the best in technology resources to help our clients find what they are looking for or confirm it does not exist. Our services are tailored to time sensitive business or legal environments and encompass:

• In-house and audit committee investigations
• Preparation for potential future disputes
• Class action settlements
• Litigation support for counsel or expert witnesses
• Arbitrations or special proceedings

With offices worldwide, our network of professionals is able to provide seamless, efficient solutions to our clients no matter where they reside. Using our Forensic Technology Solutions Centres, we offer cutting edge technology to best serve our clients' needs.

Our services to audit committees, litigators, regulators, business analysts, and company management include:

• Electronic evidence services
   -Responding to electronic records notices, orders, and subpoenas
   -Acquiring and analyzing computer files
   -Acquiring and analyzing emails
   -The importance of networks
   -Transaction and accounting data
• Litigation support analysis services
• Claims management services
• Discovery management services
• Systems failure/IT liability expert services
• Business application development services
• Records management advisory services
• Forensic technology solutions systems centres

With as much as 90% of all business records now created and stored electronically, it is rapidly becoming the rule rather than the exception that discovery opponents will seek production of your clients' electronic records. And modern technology that allows massive transmission and storage of electronic information invites abuse. For example, hackers steal information or damage systems; others perpetrate traditional offenses such as fraud, using computer technology. Simply acquiring and analyzing these huge volumes of data requires experienced investigators -- professionals trained in the forensic acquisition and analysis of electronic evidence.

Efficiently and effectively identifying, preserving, retrieving, and analyzing electronic data in support of an investigation or ongoing litigation has become fundamental to understanding and resolving disputes, and requires that the following questions be addressed:

• What relevant electronic and hard copy records exist?
• Where is the information located and what systems contain relevant data?
• Have appropriate preservation steps been taken to avoid overwriting data that could result in spoliation claims?
• Do backups exist, and if so, how and where are they maintained (e.g., tape, optical drives, on-site, off-site)?
• What forensically recoverable electronic logs and other "digital fingerprints" exist that can be used as crucial evidence?
• Is the review of electronic data being done in an independent manner so as not to compromise the evidentiary value of the material?

Responding to requests for electronic information can be perplexing. First, identifying responsive information from huge stores of data — frequently measured in terabytes — can be time consuming, disruptive, and costly. Second, extracting data from computers in ways that reliably preserve evidence is not a simple undertaking, as data can easily be altered either intentionally or accidentally. Recognizing these facts, litigators and investigators in both civil and criminal cases have begun to focus carefully on electronic discovery and the role of computer forensics -- the science of reliably recovering and handling electronic storage media and the data contained therein so as to provide the appropriate foundations for admissible evidence.

PwC' electronic discovery teams bring a highly professional, collaborative approach to our clients' electronic discovery needs. Using our proprietary tools and forensic laboratories worldwide, we can efficiently find, retrieve, preserve, analyze, and process a wide array of electronic information.

We assist clients by designing and implementing preventative measures such as:

• Information system policy and procedure reviews for electronic document retention and destruction
• Compliance reviews to ascertain whether policies and procedures are being followed
• Assistance in drafting/negotiating preservation and production agreements, orders, and document retention letters.

During discovery, we assist clients by providing:

• • A full spectrum of information system-focused investigative capabilities, including specialists in traditional commercial litigation matters, criminal investigative proceedings as well as SEC and other regulatory inquiries/investigations
• Computer Forensics — forensic images of media (personal computers, servers, backup tapes, other systems) and review of deleted/damaged data
• Inventory and mapping of relevant data sources and systems
• Analytics and processing of e-mail and other data including enterprise wide data storage and database systems
• Support for attorney work product, privilege and relevancy reviews of electronically stored data
• Creation of production sets (i.e., CD ROM, hard copy, web)
• Affidavits, declarations, expert reports and related testimony pertaining to the aforementioned
• Expert testimony in support of legal positions with respect to an electronic discovery request.

Forensic technologists are commonly retained to acquire and analyze computer files. At the start of most litigations or investigations, counsel often needs to move quickly to preserve vital evidence held on employees’ or other parties’ computers. We can rapidly deploy staff anywhere on the globe to gather forensic images of computers using recognized tools and techniques. We then work with counsel to review these images to identify key files as well as find any deleted or hidden files that remain on the hard disk -- deleting a file does not remove it from the hard drive.

Given the prolific use of email as the communication tool of choice within most organizations, it is not surprising that many litigators and investigators specifically focus on email during discovery. However, email poses the forensic investigator with some unique challenges.

• Emails are often found in a number of different places, for example one email may be found in the senders mail box on their hard drive, on network mail boxes and in the backups on the network and in each of the recipients’ mail boxes.
• Some emails have attachments that may contain vital evidentiary matter
• The high volume of emails often necessitates the use of keywords to focus a review.

To facilitate an effective review, PwC utilizes its proprietary tool to identify exact duplicates of emails to be removed throughout a network. Moreover the tool can quickly and efficiently search emails and their attachments using keywords. Finally, the tool allows redaction of the emails and Bates stamping to enable unique identification of all documents.

A fast-growing area which presents significant risks to corporate networks, is discovery orders in litigation matters. Over the past several years, attorneys have come to realize the discovery potential of e-mail and electronic document storage. As a result, courts are increasingly issuing and enforcing orders for the production of massive quantities of stored electronic documents (including back-ups). Such orders often require the suspension or alteration of normal network storage, back-up, and archiving routines because these normal operating procedures may result in the destruction of documents covered by the discovery request (e.g., the re-use of back-up tapes may cause the deletion of files covered by a preservation order, leading to sanctions or negative inferences in court). Unless appropriate policies and practices are developed in advance of litigation, the effects of such orders on organizational operations can be severe.

Even if properly prepared, responding to a broad discovery order can be difficult. PricewaterhouseCoopers can assist in the preservation of electronic records (including email), and can help corporate and outside counsel identify and respond to discovery requests by locating and producing responsive materials from very large network environments in an efficient and cost effective manner. We recover data using accepted data recovery techniques so that we can testify as to the validity of our computer forensic operations, thus allowing us to authenticate your discovery responses. In appropriate cases, we can assist in challenging unreasonable discovery requests by preparing affidavits explaining the full implications of a proposed preservation and/or discovery order, or challenge the integrity of the data provided in response to your own law firm's discovery requests.

Transaction or accounting data extracted from an organization’s general ledger is often the heart of a damages claim or an accounting investigation. However, many corporations find it difficult to undertake the demanding analyses required during an investigation or litigation due to both time and systems capability constraints. Working with our colleagues in the investigative group or directly with attorneys, we are able to quickly extract information from a corporate system to allow in-depth analysis of corporate data. Once out of this environment, the data may be reported on in new and innovative ways. For example, management of key earnings at the end of a company’s accounting period may be found by the daily trial balances obtained from a general ledger. This can often lead straight to the journal entries at the heart of a fraud.

The complexities of electronic discovery require a disciplined and experienced approach to manage the various issues you will face. PwC Forensic Services bring a rational, knowledge-based approach to our clients, helping to streamline the litigation process and bring about a successful outcome.

Our professionals will help ensure that your discovery requests result in:

• Complying with your preservation and production responsibilities
• Reducing the time and cost needed to review materials
• Preserving the evidentiary value of electronic information
• Validating legal positions
• Bolstering credibility

The risks inherent in any IT project, large or small, can be far reaching. Cases now clearly document that material deviations from budget, schedule and requirements can bring a business down. Such problems can be caused by a variety of factors including unclear requirements, miscommunication among interested parties, poor technical design, scope creep, or general mismanagement of resources.

PwC professionals are able to assist clients who grapple with complex technology issues in instances where computer system projects have not met expectations. Systems Failure disputes cover a wide range of issues leading to allocation of liability and damages, including project management failures, technical design and development failures, and operational failures such as deviations from service levels in an outsourcing contract.