Don’t underestimate your forensics company.
They should be able to let you know extremely specific information, such
as the exact time someone logged in or out of a computer, what websites were
visited, when the user opened programs, and what programs were accessed
frequently. They may even be able to
reconstruct documents printed by the computer or find filenames and extensions
that had been changed by the user.
You need to think about what you need to prove, and let the
engineers know. They’re under
nondisclosure agreements, and you should fully confide any relevant information
with them. Avoid giving these details to
any other representative of the company, however.
With a good computer forensics
company, your case stands a much better chance of being successful. Be sure to
communicate with your lawyer and the engineers working on your case, and with a
little help you can quickly receive the information you need.