Objective

A former partner of the legal firm was under investigation for misconduct. It was unknown to the client if the person under investigation had user data and emails present on a redundant server still retained by the clients IT department.

The client a large UK based legal firm required a search for data belonging to a former partner at the firm, to confirm if anything was present on a redundant server previously used for business data prior to going cloud based.

The physical server was a 12 disk (18TB in total) RAID 6 which contained 6 Virtual servers.

Process

LDS used state-of-the-art equipment backed by engineering knowledge, to interrogate the data in detail. The data search was performed on good data, deleted data, and raw recovered data to provide to cover all possible scenarios.

Outcome

After searching all the data and interrogation of the server, it was concluded that the user data was not present and highly likely was never present on this server. This was in line with the clients own investigation running alongside LDS’s that concluded that the data was not copied over from a previous server by their IT maintenance provider given the partner had left the company some time before.

Had data been present LDS would have provided it in an image form with data location as well as recovered raw data if previous deleted, for the clients digital analysts to interrogate.