This article accompanies To Find the Truth.
Whether you're investigating a complex case of corporate espionage or a simple act of discrimination, digital forensics can play a pivotal role in gathering evidence.
Think an email has been permanently deleted? Think again. Hoping that your web history has been permanently erased? Chances are, it's still there.
Rob Kleeger hears from companies when they need to start gathering evidence. As managing director of The Intelligence Group, a Bedminster, N.J.-based business-investigations firm, he can take a "snapshot" of virtually any electronic device -- from computers to iPads to cell phones ... even copiers -- to create a read-only encapsulation of its content.
There's no need to disrupt the business by removing an entire computer from a workplace.
Very rarely is information deleted completely, says Kleeger. "It's in a space by which, forensically, you can recover that deleted information," he says.
That means his team can facilitate email or Internet searches or reveal when someone last accessed a document or spreadsheet. Then, they can go through that information to find evidence of wrongdoing.
The only way to completely remove data is by overwriting it, which occurs randomly or with sophisticated anti-forensic software.
But, Kleeger says, he can even detect such software.
"Many people don't realize that, even if you overwrite everything, it leaves a trail," he says.
There are certain things he can't do -- such as hack into someone's private Facebook page.