TLS Project Manager Spotlight: Navigating Remote Digital Forensics in a WFH World

Meet Alex Seigle-Morris, Director of Forensic Technology and Consulting in TLS’s London office with nearly 15 years’ experience in digital forensics. Director of Strategic Accounts, Sasha Toussaint, spoke with Alex to discuss his time in the industry, how it’s adapted in a work-from-home world, and how to navigate digital forensics remotely.

How did you end up with TLS?

I started off running a record label/recording studio and was also a club promoter. In the former role, I grew my knowledge of computers as we didn’t have tech support – I had to troubleshoot myself!

As the music industry shifted (and I got older), I wanted to try something else.

I got hired as an entry-level digital forensics investigator. I subsequently worked at a few other firms and was eventually recruited by TLS to lead its European Forensic Technology and Consulting (FTAC) team. It’s been seven years now!

You previously worked closely with the London Met Police. What was the most important lesson from that experience?

My biggest takeaway was on evidence handling and chain of custody.

I still work under the assumption that any piece of data we collect could end up in a high-profile criminal court case. And, worst case scenario, if done incorrectly, could be inadmissible evidence.

I approach every collection methodically so that it cannot be challenged.

What has been your most unexpected project at TLS so far?

I’ve learned to expect the unexpected.

The wildest thing I’ve come across was an instruction – actually, a presidential decree – to put spy software on a government official’s computer who was suspected of embezzlement. The computer was a different model from what we were originally told, so I had to return the next day to complete the installation. Only complication: said employee was on their way to the office from the airport, and I needed to install and leave the premise before he arrived!

What have you seen trending in the legal tech industry in the last few years?

The main trend I’ve noticed doesn’t concern AI, analytics, or any of the fancier tech we’re involved in. It’s the explosion of different data sources.

Years ago, we would only have to collect from computers. Now, cloud storage, mobile phones, collaboration platforms, CMS and even devices like Alexa or monitors on wind turbines can have data material to cases.

Fortunately, our forensics team has really been ahead of the curve on this and has developed special tools to collect from/present content from some data sources.

Much of your work pre-COVID was related to collecting data on site. How have you adapted?

Almost all of our work is now completed remotely. We’ve always offered this service, but many clients – before lockdown – preferred boots on the ground. We've all had to adjust.

Now, we send a remote collection kit (usually encrypted media and software, at least) to the client, and then I video call them and remotely control their computer to initiate data preservations similar to if I were there in-person.

We also recently developed a mobile remote kit for collections of mobile phones and tablets. We send a laptop to the client so I get remote access to the device and perform the collection that way.

What goals do you have for you and your team as we approach the end of 2020?

I oversee the EMEA and APAC regions, and one of my goals is to grow the team so we have a larger presence and more resources there. I'd also like to see us perform more investigatory work because we're highly qualified to do so.

Many clients focus on document review to see what data supports or undermines their case. That’s what the data we collect is used for.

However, running forensic investigations on devices gives important insight into what nefarious activities the subject of an investigation was up to on their device, besides storing and sending documents.

It often gives another evidential dimension to a case, particularly to help clients understand what happened “under the hood” and how those events can support the case at a deeper level. We are experts on this as well as the collection phase, so I hope more clients leverage those capabilities.

Sounds like you spend a lot of time in the forensics lab! How do you unwind?

My free time is family time. I have two young daughters, so it’s spent playing games and reading! I also go for a swim every day.

If there is any time left, I go back to my roots and spend time on my music – although it’s purely for the fun of it these days!

For more information on TLS’s digital forensics solutions, visit our website.