Encore Success Story

Covert Data Acquisition for SEC Investigation

Problem: Encore was called in to collect data from hard drives and servers related to an SEC investigation at a publicly held financial services company. The collection had to be forensically sound and–because it was a fraud investigation–the employees could not know.

Solution: Under direction of Vice President of Forensics and Analytics Warren Kruse, Encore sent in a team of four people on a Saturday. With the help of the client’s legal team and IT staff, the team was able to make a complete forensic copy of 10 hard drives and 3 servers in less than nine hours. 

Knowledge: On this project, Encore was able to leverage the expertise of Warren Kruse, and his many years of experience in forensic matters. Kruse has worked on dozens of projects where users could not know their computers were being worked on. Because the time frame was so tight, all team members were Encase® Certified Examiners and some specialized in acquiring data from Microsoft Exchange servers.

Process: Because the company’s employees could not know about the investigation, Kruse and Encore’s account manager for this client, Shawnna Childress, set up a careful process. Once digital photos were taken of each office so that machines could be returned exactly as they were found, all machines were moved to a conference room to facilitate quick data transfer. Afterwards, everything was put back in place exactly where it belonged.

Technology: The tools used on this project ranged from simple–such as sticky notes placed on desks to ensure computers were replaced properly–to the much more complicated use of Guidance’s Encase® forensic investigation software. Encore was also able to use keyword-searching tools to cull down the size of the data to reduce the document review process.