简体中文
English
Website review
This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.
What is Forensicon?
Forensicon is the Chicago-based computer forensics division of QDiscovery, a firm that provides digital forensics analysis, expert witness testimony and eDiscovery consulting to clients across the United States. Its stated work covers investigating digital trade secret theft and data misappropriation, internal investigations into employee wrongdoing, internet investigations, ESI preservation and on-site collections, discovery production, and forensic reports and affidavits. It also offers ESI discovery consulting to help clients map their sources of electronically stored information before litigation and production requests.
Who it serves
The core client list is litigation-oriented: law firms and litigation service companies, software and consulting firms, financial services institutions, industrial equipment corporations, government and non-profit organizations, and healthcare, hospital and insurance providers. In practice, that means the typical engagement starts with counsel who needs defensible evidence handling rather than with an individual consumer.
Where it fits in a case
- Trade secret and misappropriation disputes: examining devices and accounts for evidence of data taken or misused.
- Employment and internal investigations: auditing how a company's IT department preserved data, as in the firm's described engagement defending a financial services company against discrimination, harassment and retaliation claims.
- Sanctions defense: the firm cites a case in which its senior examiner's analysis helped defeat a motion for sanctions.
- Expert testimony and reporting: producing affidavits and reports intended to withstand admissibility challenges in federal, state and county courts.
A practical next step
If you are counsel facing a preservation dispute or a suspected data theft, the useful first question is whether you need an independent audit of what opposing or internal IT already preserved, or a fresh collection from devices and cloud sources. Forensicon's described work covers both, so scoping the engagement around the specific legal question—sanctions exposure, spoliation risk, or proving what was taken—will shape cost and timeline more than the service list itself. For related eDiscovery and litigation support options, see QDiscovery.
When should a law firm hire a computer forensics expert witness instead of relying on internal IT staff?
Hire an outside computer forensics expert witness when the dispute will turn on how digital evidence was found, handled or explained—not merely on whether IT can retrieve a file. Internal IT staff are usually best at keeping systems running; a forensic expert is brought in when the evidence must survive scrutiny in litigation.
Forensicon, a Chicago-based computer forensics division of QDiscovery, describes its work as including forensic analysis, expert testimony and eDiscovery consulting, with experience testifying in federal, state and county courts. Its listed project types include digital trade-secret theft investigations, internal investigations of employee wrongdoing, ESI preservation and on-site collections, and forensic reports and affidavits. That mix points to the situations where an outside expert earns its cost.
Signals that internal IT is not enough
- The matter is likely to be litigated or already is. Preservation, chain of custody and admissibility become legal questions, not just technical ones. Forensicon states its reporting has been upheld as admissible.
- The opponent will attack your process. If IT preserved data informally, an independent audit or re-collection may be needed. Forensicon describes an employment case where a financial services company's IT department had preserved some data, but counsel wanted an independent firm to verify the techniques used.
- The evidence concerns employee misconduct or data theft. Investigating a colleague's devices creates conflict-of-interest and credibility problems for in-house staff.
- You need testimony, not just a report. A report is only useful if someone can defend it under cross-examination.
- The collection is time-sensitive or complex. On-site collections, mobile devices and cloud accounts require documented procedures that ordinary IT workflows may not follow.
When internal IT is the sensible first call
Routine email exports, access-log checks, backup restoration or a quick preservation snapshot can often be handled internally, especially if counsel directs the process and documents it. The trade-off is cost and speed versus defensibility: outside experts add expense and scheduling lead time, but reduce the risk that evidence is excluded or undermined.
A practical decision rule: if you would be uncomfortable having your IT administrator explain the collection method to opposing counsel, involve a forensic expert before data is touched. The earlier step is usually a short consultation with counsel and a forensic firm about preservation, which is cheaper than repairing a flawed collection later.
How does Forensicon preserve electronically stored information for litigation and discovery production?
Forensicon's stated approach to ESI preservation centers on on-site collection and defensible discovery production. According to the site, the firm handles "Electronically Stored Information (ESI) Preservation & On-Site Collections and Discovery Production," and also helps clients map their sources of ESI ahead of litigation and discovery requests. It presents its reports and affidavits as having been upheld in court as admissible, and it offers expert witness testimony in Federal, State and County courts. The site also notes that its examiners have audited and verified preservation methods used by a client's internal IT department—an independent check rather than only a first-pass collection.
What that means in practice
The site describes the what (preservation, on-site collection, production, affidavits, testimony) but not the how—specific tools, chain-of-custody steps, or protocols aren't detailed in the available page content. So the practical value lies in the combination of services: collection, documentation, and the ability to defend the process in court.
A concrete reader scenario: a law firm receives a broad discovery request and the client's IT team has already copied some mailboxes and shared drives. The risk is that the internal preservation is incomplete or undocumented. A firm like Forensicon would typically be engaged to identify all ESI sources, collect from custodian devices and servers on-site, document the method, and produce data in a reviewable format—then supply an affidavit or testimony if the preservation is challenged. That is general practice for forensic ESI work; the site confirms these service categories but not the specific steps.
How to choose
| If your need is… | What to look for |
|---|---|
| Challenging opposing preservation or sanctions | Examiner willing to testify and produce affidavits; check court experience |
| Defending your own collection | Independent audit and verification of internal IT preservation |
| Trade secret or employee misconduct matter | Forensic investigation plus ESI production in one engagement |
| Routine document production | Clear scope, format, and cost agreement before collection begins |
Forensicon's listed client base—law firms, financial services, healthcare, government—suggests it is oriented toward litigation-driven engagements rather than routine IT backup. If your matter is small or budget-sensitive, ask early about scope and how on-site collection is priced, since the site gives no pricing signals.
Next step
Before retaining any forensic firm, ask for a written collection plan: which custodians and sources, what is imaged versus copied, how chain of custody is recorded, and what deliverables (load files, affidavits) you will receive. Compare that plan across providers—for broader eDiscovery review platforms, see QDiscovery, Forensicon's parent organization per the site.
What types of digital evidence does Forensicon analyze in trade secret theft and employee misconduct investigations?
Forensicon's stated project types point to three main evidence areas in trade secret and employee-misconduct matters: company data misappropriation, internal investigations into wrongful employee activity, and internet investigations. In practice, that means the firm examines the digital traces left when data leaves an organization or an employee's conduct is questioned.
Likely evidence categories
- Company data and files: documents, databases and other business records relevant to alleged misappropriation, based on its listed "digital trade secret theft / company data misappropriation" work.
- Employee devices and accounts: material tied to internal investigations of wrongful activity, such as work computers and related stored information.
- Internet and online activity: the firm lists internet investigations as a separate project type, covering evidence of online conduct.
- ESI for litigation: preservation, on-site collection and discovery production, plus reports and affidavits that can support a case.
How this fits a real matter
Consider an employee who resigns and later launches a competing venture. Counsel may need to show which files were accessed or copied before departure, and whether preservation was handled properly. Forensicon's combination of collection, analysis and expert testimony is suited to that sequence: preserve first, analyze second, then present findings in a report or on the stand. The page also notes an employment matter where the firm audited an internal IT department's preservation methods, which is a useful model when opposing counsel challenges how evidence was kept.
Decision criterion
Match the evidence type to the dispute. If the core question is "what was taken," focus on device and file analysis; if it is "how was evidence handled," an independent preservation audit matters more. Confirm scope and deliverables directly with the firm before retaining it.
How can Forensicon's forensic reports and affidavits be used to support a motion for sanctions?
Forensicon's forensic reports and affidavits work as the evidentiary backbone of a sanctions motion: they document what happened to electronically stored information (ESI), who was responsible, and whether preservation duties were met, giving the court a factual record rather than an accusation.
How the reports and affidavits support a motion
- Establishing spoliation or mishandling. A forensic examiner can describe deleted files, wiped devices, altered metadata or gaps in preservation, and tie those findings to specific custodians and dates. The affidavit converts that analysis into sworn testimony a court can weigh.
- Testing the other side's preservation claims. Where a party says its IT department preserved data properly, an independent forensic audit can verify or contradict that account. Forensicon's page_evidence describes exactly this use in an employment case, where counsel wanted an outside firm to audit and verify internal preservation techniques.
- Supporting admissibility and reliability. The page states the firm has testified as an expert in federal, state and county courts and that its work and reporting have been upheld as admissible. An affidavit from a qualified examiner helps satisfy the threshold for expert evidence and rebut challenges to methodology.
- Framing the remedy. Reports can quantify the scope of loss—for example, which ESI categories are unrecoverable—which counsel uses to argue for adverse inference instructions, exclusion of evidence or fee awards. The Loest & McNamme v. Camera / Broadbent Selections matter on the site illustrates analysis being used to defeat sanction allegations, showing the same evidence can cut both ways.
A practical scenario
Imagine a departing employee who copied files to a personal drive and then ran a deletion tool. A forensic report could reconstruct the timeline, identify the device and account involved, and an affidavit could attest to the method used. Counsel then attaches both to a sanctions motion, pairing the technical findings with legal argument about the duty to preserve.
Decision criteria
Ask three questions before commissioning work: Does the examiner's report address the specific custodians and time window in the motion? Is the methodology described in enough detail to survive a Daubert-style challenge? And does the affidavit speak to both what was found and what could not be recovered? A report that answers all three is far more useful than one that only asserts wrongdoing.
For related technical context, the official sites of QDiscovery and EDRM publish material on ESI preservation and discovery practice.
What does Forensicon's relationship with QDiscovery mean for clients needing eDiscovery consulting?
Forensicon is the Chicago-based computer forensics division of QDiscovery, so clients get forensic analysis and eDiscovery consulting under one organizational roof. In practical terms, a law firm that hires them for one side of a matter—say, preserving and analyzing employee devices—has a direct path to the discovery-production side without handing the case to an unrelated vendor.
What the relationship changes for a client
- Continuity between forensics and discovery. The page describes both forensic analysis and ESI discovery consulting, including helping clients map their sources of ESI before litigation and production requests. A single division covering both reduces the friction when a forensic finding becomes a discovery obligation.
- One point of accountability. Because the forensics work sits inside QDiscovery rather than at an outside partner, questions about how data was preserved, collected or produced can be directed to the same organization.
- A litigation-facing posture. Forensicon states it has testified as an expert in federal, state and county courts and that its reporting has been upheld as admissible. For clients, that matters most when a preservation or collection decision is likely to be challenged.
Where the fit is strongest
The page's core project list points to matters where digital evidence and discovery overlap heavily: trade secret theft and data misappropriation, internal investigations into employee wrongdoing, internet investigations, ESI preservation and on-site collections, and expert testimony. Its stated client base—law firms, financial services, healthcare and insurance, government and nonprofits—suggests matters where chain-of-custody and defensibility carry weight.
A reader scenario makes the trade-off concrete: a financial services employer facing discrimination and retaliation claims, whose IT department preserved some data but whose counsel wants an independent audit of those preservation techniques. That is exactly the kind of engagement the page describes, and it is where an integrated forensics-and-eDiscovery provider earns its keep—the audit, the collection method and the production can be reasoned about together.
Decision criteria
Choose this kind of integrated provider when forensic findings are likely to feed directly into discovery disputes or sanctions motions, and when you want preservation decisions documented by the same team that will defend them. If your need is narrow—a single expert report, or pure document-review capacity with no forensic component—the combined offering may be more than the matter requires.
As a next step, ask prospective counsel or the provider two questions before retaining: who specifically performs the collection versus the discovery consulting, and how the preservation methodology will be documented if challenged. For general background on the parent organization, see QDiscovery.
hostinger.com.ua
User reviews (0)