Forensics Investigations

Industry/Sector:  Healthcare

Type of Case: Cybersecurity Investigation

Description: Retained by a large medical device company to reverse engineer and reconstruct hardware and software environments that were hacked and destroyed in a complex cybersecurity attack. Efforts included:

• • Restoring systems from backups.
  • Capturing from air gapped computer systems and software configuration and creating a master image.
  • Restoring hundreds of laptops, desktops, and servers.
  • Collecting data from logs, recovered data fragments, backup images, and other sources to assist counsel in filing a nine-figure cyber insurance claim.

Industry/Sector: Military and Defense

Type of Case: Employment and Cybersecurity

Description: Hired by general counsel to conduct a network forensics investigation around theft of key intellectual property via cyberattack perpetrated by former employee. Efforts included:

• Conducting a forensic investigation of the attack using industry standard solutions and our patented threat scanning platform, Forensic Scan (www.forensicscan.io).
• Interviewing multiple staff members connected to the former employee to determine critical details connecting the employee to the intellectual property theft.
• Analyzing the cyber attack vector and infected devices in a manner that discovered the underlying theft of intellectual property of the former employee.
• Providing a detailed expert report documenting and calculating the damages to outside counsel; who used the report in calculating economic impact, resulting in a positive outcome for the client.

Industry/Sector: Energy

Type of Case: Trade Secret

Description: Ran a digital forensic investigation at the direction of outside counsel for a clean energy company involved in a hotly contested trade secret case. Efforts included:

• • Identifying parties of interest, collecting, and analyzing these users accounts and devices to determine if information had been misappropriated.
  • Demonstrating that large amounts of copying by departing former employees of confidential information occurred.
  • Creating a forensic inspection protocol that was adopted by the parties and performed the associated work with protocol including submitting a report to the court and parties that facilitated settlement.