Tools of the Trade

Why Letting Clients Self-Preserve Can be a Bad Idea
guest author: Gregory L. Fordham

Clients often have technology staff in-house that help with the administration of their computer systems. Nevertheless, client personnel are not a good source for forensic expertise and there are several reasons that this is true.

First, they are not normally involved in forensic processes. Rather they support the organization in the execution of its mission, which is not litigation or forensic services. The difference is often like the difference between the infantry and the special forces. Both may be able to fire a rifle but the ways in which they use them are entirely different. Even the rifles themselves are different because a forensic expert will likely have different tools to examine media and its contents than a client's in-house technical support staff.

A second drawback to using client personnel is that there will be "combat". Litigation is not just using a weapon to fire at paper targets. Further down the line there will actually be contact with the enemy, so to speak. Unless the client personnel have done that kind of thing before, they are likely a less attractive choice than someone that is combat experienced.

Third, a lot of what happens in even the early stages of the collection and analysis process is to prepare for the "combat" that will happen later. Thus, considering less capable client personnel could be like bringing a knife to a gunfight.

Fourth, in a 2014 Pokemon survey of IT security professionals less than 8 percent would recommend using an outside consultant to assist with the analysis of a data breach; but, more than 50 percent of those same respondents claimed that their staffs lacked the tools or the training to determine the cause of the breach. These survey results are highly relevant to the selection of a forensic expert particularly when one considers that client IT personnel are more closely aligned to the breach issue than to providing litigation support services. Thus, if they are not well prepared for something more closely aligned with their actual job function, how well will they perform on something that is not aligned to their job function?

Finally, there have been a number of spectacular cases involving spoliation and sanctions involving ESI preservation by client personnel. The lesson that gets learned over and over is that whenever client personnel are involved in the preservation process warning bells should go off and special attention should be given to depose and review exactly what they have done. In the end, therefore, using client personnel may cause more problems than they solve and raise costs accordingly.


Gregory L. Fordham is the founder of Fordham Forensics, Inc., based in Atlanta, Georgia. He provides forensic accounting and computer forensic, and e-discovery consulting services to attorneys in complex litigation cases nationwide. Although his cases have involved a wide range of labor related issues like claims of harassment, discrimination, and wrongful termination; he is most often involved in asserting or defending matters involving restrictive covenants and misappropriated trade secrets. Mr. Fordham is a certified public accountant in Virginia, and a certified internal auditor by the Institute of Internal Auditors. He has also added several professional certifications reflecting his computer forensic expertise, including certified computer examiner by the Internal Society of Forensic Computer Examiners. He earned his B.B.A. degree from Emory University in Atlanta.

Institute for Paralegal Education • 1218 McCann Drive • Altoona, WI 54720 • © 2019, Institute for Paralegal Education, a division of NBI, Inc. All Rights Reserved.