Often during the initiation of an investigation, a user may engage in mass or target deletions of data, data shredding, and data wiping on a computer subject to preservation and examination. This may occur just prior to a user’s handing over of his computer to law enforcement, his counsel, or his adversary in a criminal or civil investigation. Stroz Friedberg has proven expertise in forensically identifying and time-lining such obstructive behavior and in attempting to recover the deleted items in cases ranging from theft of trade secrets, insider trading, foreign corrupt practices, viewing pornography in the workplace, or trading with the enemy. Our digital forensic examiners are careful to attempt to distinguish between intentional activity targeting important data and innocent system activity, normal-course deletions, or scheduled, automatic actions. Our reports and testimony in this area can often assist counsel in pressing or defending spoliation charges, which if well-founded can be case-dispositive.