In today’s electronic world, where filing cabinets of information can be copied onto a device small enough to swallow, litigators are increasingly turning to forensic investigators to help identify the data that could make or break their case. This is creating a growing industry, from specialist teams within the big four accountancy giants, to individual consultants. But with so much at stake, how can litigators choose which company to instruct?

David Greene, president of the London Solicitors Litigation Association and head of litigation at London firm Edwin Coe, says: ‘We are following the US’s lead in bringing in forensic computer and accounting specialists at a much earlier stage, because of pre-action requirements to set out damages.

‘However, while we are litigators, we are also problem-solvers and, as part of that role, we will pull in forensics where a company is worried that they may have breached restrictions on anti-competitive practice. We need them to find out the extent of the problem as quickly as possible, so if the company has to go to the regulators, it gets in first. If the raid is already happening and the regulator’s investigators are crawling all over the company, you need your lawyers to sort out your position, and forensics to find out the truth.’

And the results can be ‘spectacular’, says Keith Oliver, senior partner and head of commercial litigation and civil fraud at London firm Peters & Peters. ‘I am involved in ongoing cases where investigations of former employees have started with a line-by-line review of material retained on hard drives, some of which has been deleted. This is why forensics is so important – you can show, by reference to extraneous events, the dates on which particular key documents were deleted, which is incredibly important evidentially in proving a fraud, or in civil recovery steps.’

International computer forensic consultancy Stroz Friedberg specialises in establishing what happened when on a computer, and in collecting data for e-disclosure. As Seth Berman, managing director of the London office, explains: ‘It is the difference between looking through the filing cabinet, and fingerprinting the outside to see who went in it.’

Stroz has 12 computer experts based in London. ‘It can mean sneaking in late at night to make a copy of a computer without the person who uses it having any idea it has happened,’ he says.

‘There are lots of legal issues involved but, in certain circumstances, it is permissible to make a copy of someone’s computer over the network, and watch what they are doing as they are doing it.

‘If a case gets to trial, we are regularly called as witnesses of fact to show that a particular document was found on someone’s computer, or as expert witnesses to demonstrate, for example, how a document has been altered or a computer hacked into.’

In one investigation, the target was a computer expert. ‘He was erasing material as the warrant was knocking on the door,’ Berman says. ‘It is difficult to delete things without leaving a trace, but he had managed to erase key documents. However, he forgot the backup tapes from the day before, so it was one of those great moments in a lawsuit where you find both evidence of bad faith and the actual documents.’

When global risk consultancy Kroll was called in by the board overseeing the liquidation of Icelandic bank Glitnir to carry out a forensic investigation, it stationed a team in Reykjavik for 12 months. The result is a $2bn US lawsuit that accuses one of the main figures behind Iceland’s banking boom and bust of a ‘sweeping conspiracy’ which contributed to the bank’s collapse. The individual has denied the allegations and is contesting the case.

The playersThe big four accountancy firms increasingly provide an ‘end-to-end’ service, from the forensic collection of data to hosting e-disclosure platforms for lawyers to review material pre-trial.

Neil Mirchandani, a partner in the securities, investment banking and funds litigation group at City firm Hogan Lovells, notes that the quartet ‘are investing heavily in the forensic data collection side, hiring in computer expertise, as they see this as a growth area’.

Deloitte, for instance, has a 37-strong analytic and forensic technology team. Phillip Sealey, who left the Serious Fraud Office 12 years ago to set up the team, says: ‘We cover the whole life of information, from pre-raid advice on what clients should be aware of should something happen, to collecting data when something has happened, to working with the clients to look at it and present it at court. We have ambitious plans to grow over the next three to five years, with a permanent recruitment drive and investment in new technologies.’

Mirchandani says there are also some high-quality teams among the top dozen or so practices in the next tier: ‘They are also less subject to conflict issues. PricewaterhouseCoopers, for instance, audits about 40% of the FTSE 100, and they wouldn’t investigate an audit client.

‘However, the practice you choose may be based on whether a certain individual is available. You are ultimately paying for someone who is potentially going to be giving evidence at the trial, which is why there are at least four or five practices which match the big four.’

Then there are the specialist companies such as Kroll, he continues, with capability in multiple jurisdictions: ‘There are also domestic players who you would bring in on a "horses for courses" basis, who may be as good as the bigger players and are quite often cheaper.’

For Tommy Helsby, chairman of Kroll’s Europe, Middle East and Africa region, the advantage of instructing his company is that it has more external credibility than even a very good boutique firm: ‘We will have the edge because, when a report is being presented to a third party, our name carries more weight. We will also have more experience abroad and across disciplines.’

Adrian Palmer left Kroll Ontrack, the consultancy’s technical services division, in 2006 with five colleagues to set up Palmer Legal Technologies. Palmer’s size has more than doubled, to 11 staff, in four years. On one occasion, he says, a client rang at 5am to say they had been notified that regulators were about to conduct a raid. ‘The client wanted someone there immediately to take notes on the systems they were imaging, replicate what they had done and then go through it faster than they could, so the client could hold their hands up first if need be. We have invested in more powerful conceptual searching systems than most regulators have, so we can often get to the nitty gritty before they can.’ He adds that one advantage of a small firm is ‘our conflict checks take about 30 seconds, unlike the big four’s, which may take one or two days’.

Sealey admits conflict issues are a ‘bugbear for the big practices – it may be a day or two before we can even step on site’. However, he says that Deloitte brings other advantages: ‘We have master services agreements with some clients, where we have all the paperwork in place and clients can just call us in. We also have people all around Europe and can pull together a mammoth team at very short notice. We had one case coming out of the US where we went into 53 countries.’ He stresses that the firm will ‘do everything’, from ‘a project involving a single machine, to the biggest we have done, which involved 3,500 machines’.

Burden of choiceCharles Holloway, a former Eversheds litigation partner and now managing director of litigation support consultancy Millnet, believes lawyers need to have a list of well-researched providers in their armoury early on. ‘If a client calls with a problem, you don’t have time to check references,’ he says.

Critical issues in choosing a provider, says Mirchandani, are ‘confidentiality and evidentially clean data’. He cautions: ‘People who don’t meet those standards generally don’t survive. Quite often, the company’s own security requirements are greater than the clients’. Reputation in the market counts for a lot.’

Mike Taylor, a non-practising barrister, says that it can be hard for litigators to keep on top of a market of 50 to 60 forensic investigators and e-disclosure providers, and to be ‘agile’ enough to swap between them to get the best value for their clients. This led to his decision, in 2006, to leave Kroll and set up i-Lit, a legal IT consultancy. ‘I spotted an opportunity in the market to become, effectively, a gun for hire for mid-tier law firms who don’t have an in-house litigation support function,’ he says. ‘This means I am an occasional cost that can be passed on to the client, rather than a continuing office cost.

‘I go in at an early stage and advise on the forensic preservation of data before taking a fully scoped project to the market. I go to multiple providers, from the big to the small, with the same spec.’ He says he can add value to his law firm clients because he can ‘understand the different assumptions that are built into the costings’. He adds: ‘I can also help with communication between the lawyers and the technical experts – otherwise, the lawyers can end up believing that the providers are trying to skin their clients by doing extra work, while the techies can feel misunderstood and undervalued.’

The bottom lineAlongside reputation, cost is inevitably going to be critical – and it can be eye-wateringly large. The bitterly fought dispute between Digicel and Cable & Wireless involved a massive forensic and disclosure exercise, which could leave losing side Digicel facing costs of £15m.

David Stern, head of the six-strong forensic accounting team at professional services firm Vantis, says Vantis is called in during complex business disputes, with the work ranging from international arbitrations to commercial court cases, to some professional negligence work. ‘Litigation is so expensive,’ he says. ‘Only deep-pocket corporates or high-net-worth individuals can afford to litigate. For an accountant to be involved, there needs to be at least seven figures involved in the dispute.’

For Oliver, one of the greatest challenges as a lawyer is to manage client expectations: ‘If you are the victim of fraud, it is bad enough that money has been stolen from you. Having to invest substantial legal costs in pursuing it hurts. You have to warn clients that the investigation costs will be substantial, but you have to control the costs and make sure it isn’t an open cheque book, as nothing serves to undermine a relationship more quickly.’

Holloway says it is important to assess whether you actually need a full-scale forensic collection, where a specialist collects the data in a forensically independent way, to ensure the chain of evidence is preserved and the computers are not manipulated.

He cautions that such an investigation is ‘hugely expensive’, and says that he will often ‘advise clients that they may just need to collect an image of a hard drive, as the parties involved accept they have the documents and it doesn’t require the forensic element’.

He warns: ‘A lawyer came to us recently saying, "help, we have spent our client’s budget for the whole e-disclosure process on the forensic collection. We now have a vast amount of data which isn’t in a searchable form". I cringed, because it could have been done for a fraction of the cost, and been searchable.’

Mirchandani agrees: ‘You have to adopt a staged approach – work out how much material you think there is, based on discussions with the client, then assess the best way of collecting it. If you don’t have doubts about your staff, then collect it internally. That is a legitimate approach, it seems to me, as the cost could otherwise exceed the value of the case.

‘However, if you have a fraud, and are concerned about the staff who would collect data, you would probably want the comfort of having a forensically clean collection done.’

What is also important, Mirchandani says, is keeping abreast of developments in the market: ‘Some of the smaller players may develop a novel piece of software which you need to know about.’

Palmer Legal Technologies, for instance, has developed a tool to extract data from backup tapes, while Stroz Friedberg is trialling a psycholinguistic tool in the US called WarmTouch, which can pick up emotional content from emails.

Stroz Friedberg has also developed the ‘privilege filter’, a tool which analyses text looking for privileged documents. Berman, a former US prosecutor specialising in computer crime, explains: ‘It doesn’t just look for the word "privilege" but for phrases such as "my lawyer advised me", to flag up documents which haven’t been marked as client/lawyer privilege.’

Ensuring the instructions for, and the product of, forensic investigations are protected by legal privilege is vital, says Oliver: ‘Payment responsibility can still be with the client, but the instruction needs to come from external lawyers.’

Mirchandani agrees: ‘If there is the possibility of litigation, you would want the collection exercise protected by privilege. If a company simply instructed a forensic practice to collect the data, it wouldn’t be covered. If litigation isn’t reasonably contemplated, the collection must be done for the purpose of legal advice and assistance, and kept within the team truly advising the client.’

While computer wizardry may prove highly revealing, the way cases are handled often still comes down to human nature. As Berman says: ‘People react differently when they have been wronged. Some take the view they want to sue and crush those involved like bugs, others want to hate them quietly. We can assist in getting them to either place.’

First steps

Keith Oliver, head of commercial litigation and civil fraud at Peters & Peters, highlights the key steps you should take if a client rings and says ‘we have a problem’.

Decide on a fundamental reporting line and keep the number of people central to it as small as possible.

Establish a core team, with general counsel and director carrying authority of the board. Information must only be disseminated on a need-to-know basis, as individuals involved could be in senior posts.

Set up an encrypted offsite email system, if required, to keep information confidential and privileged.

Set out strategy. Bring in forensic computer specialists early on to collect as much information as possible in an evidentially clean way, so you get a picture of what is involved. Make sure evidence is then locked down. Once core facts are in, you may need a forensic accountant to ‘number crunch’.

Consider ‘immunising’ employees to get them to cooperate; be aware of employment law consequences when interviewing staff, particularly those ‘in the frame’.

If you need to apply for interlocutory or freezing orders, you will have to make full and frank disclosure, so gather information very carefully, because you will have to reveal to the court what you have found.

Grania Langdon-Down is a freelance journalist

This is an edited version of an article that first appeared in the July issue of Solutions, the magazine of the Law Society's Civil Justice Section. For more information on the Section and how to join, visit www.lawsociety.org.uk/civiljustice or call 020 7320 5873.