Remote working is now, and will be for some time, business as usual. This recent change to the way we operate has increased certain risks, whilst also posing new challenges when needing to conduct an investigation.
These risks should prompt businesses to think about how they would respond to any incidents requiring a forensic investigation.
Finding a balance between dependable investigative techniques and innovative new technology
Traditional forensic investigative techniques ensure the robustness of any case, and are critical to preserving evidence so that it can be presented in a court of law. However, new tools and technologies are required to remotely investigate incidents while ensuring compliance with “social distancing” and satisfying the greater need to search and collect evidence from remote devices. Visibility of the corporate network, which has now thoroughly expanded into employee’s homes, has become critical.
Some of the specific challenges posed by the current environment include:
- How can appropriate evidential standards for withstanding legal proceedings be maintained?
- How will you obtain sufficient evidence of who committed an offence?
- How can you balance a “thorough” investigation with the constraints imposed by remote working and lockdown?
- How can you securely share data with lawyers, investigators and subject matter experts while maintaining physical distance?
- How can you expedite investigations to save money?
We recommend a combination of a web based review platform that offers the latest document prioritisation tools. We summarise these below, and please feel free to contact us if you require further information.
Web based review platforms
There are number of reasons to shift your investigations into a web based review platform.
Not only does it provide physical and financial flexibility, but it also offers the latest review technologies.
Where possible, data can be neatly transferred from the source, e.g. web based email systems, into the review platform. This avoids the need to physically hand over electronic devices, whilst still maintaining the necessary chain of custody requirements.
Access to the review dataset (and subsets thereof) can be centrally managed allowing timely access to the appropriate people.
Certain tools also offer access via mobile devices, reducing the requirement to extract documents from the review platform when needing to share.
Continuous Active Learning
An investigation often begins with a small set of filters comprising keywords, individual and date ranges. This task becomes more difficult when there is a large dataset.
Consider the use of the latest review technology, ‘Continuous Active Learning’ (CAL).
CAL constantly reprioritises your review queue within the dataset based on your ongoing review decisions, therefore presenting you with documents that are most likely to be relevant within the context of your investigation. With CAL you can potentially identify 90% of the most relevant documents, by reviewing only 20% of them.
When considering current physical and financial constraints, it is possible that investigations may be comparatively scaled back. We therefore recommend that consideration be given to adopting advanced technologies that can help you focus on what is important, whilst still applying the principles of natural justice.
Incident Response Solutions 