Once the data you need has been identified, the next step is to collect the information. This is normally the preserve of vendors who provide specific services. Alternatives that normally should be avoided, are either using your own IT department to carry out the work, or letting the client’s IT personnel do the collection. See the Market Survey section for more on the issues surrounding these choices.
The skills required to provide forensic services are very specialised, and take time to acquire. Therefore the firms operating in this area tend to be relatively small, even when the team itself is part of a large organisation such as the forensic groups of the big consultancy firms. It has been known for clients to form working relationships with specific individuals in the forensic world and remain “loyal” to that individual even when they change the organisation they work for.
The requirements tend to split into two areas, the provision of forensic services and the collection of ESI in a competent manner, which might have to conform to evidentiary standards. As a rule of thumb, forensic services are normally needed when fraud is suspected and information has to be retrieved from mainstream computer systems and/or more obscure places such as mobile phones, tablet devices and on-line social network sites.
See the Procurement Section for draft requirements within this area.