18 www.DFInews.com WINTER | SPRING 2014
the same for both their digital forensics and E-Discovery
teams. Thus, unlike most organizations that have separate
components for these services, Walmart has combined
their services into the E-Discovery and Forensic Services Laboratory. By encouraging cross-training between the teams, they have established
an extensive set of resources that can be leveraged when
work surges on one team. Second, Walmart is investing in
their in-house forensic and E-Discovery program, rather
than outsourcing, which saves an enormous amount of
money. In addition to developing a hard drive recovery
capability, they are building capacities for reverse engineering SSD devices and chip off multiple
mobile devices found in business-issued
equipment or BYOD. Third, Walmart is
one of a few private sector companies that
have sought accreditation as a component
of the quality management system that
establishes their results as reliable and
defensible. It will be the first laboratory
to achieve ASCLD/LAB accreditation
under the international program for an
Describe the existing conditions
in the laboratories and the chang-
es that have occurred over time
through your recommendations?
The first thing that was evident during
my first visit to the lab was management’s
desire to ensure operations met best practices and accreditation standards.
The lab personnel associates were exceptionally talented
and competent. Lab space was at a premium with each associate being assigned a 6' x 6' cubicle. They maximized the
space by placing forensic equipment on shelves above the
workbench. This was challenging for the examiners since
access to the forensic machine is a routine requirement.
Further, it reduced productivity since it made multi-tasking
difficult. Over the course of the past two years, the laboratory has expanded and there are plans for a much larger expansion. Associates are working smarter; maximizing space
usage more efficiently. For example, they merged common
technical procedures into one common area.
Walk us through the experience of entering the
facility and getting into the lab.
The security of the building in which the laboratory is
housed is very good. It is manned with uniformed person-
nel and each person entering the building must badge in
through an electronically secured door. Visitors must register
and are escorted. The laboratory itself is secured with a
dual-authentication hand-geometry scanner combined with
a password created by each authorized associate. I considered
the overall security to be exceptional. Procedurally, we had
to make adjustments such as logging visitors into the lab.
Describe some of the enhancements that have
occurred in the lab.
The laboratory’s policies and technical procedures, generally
maintained on an internal Wiki, were formalized into Qual-
ity, Technical, Operations, and Training Manuals that map
to the international standards and industry best practices.
We identified the core knowledge, skills, and abilities that
each associate would be required to establish to be inter-
nally certified as being competent to conduct independent
casework. During our first year, we focused
on evolving those policies and procedures
into the routine of the laboratory’s work.
At the end of the first year of the project,
my staff conducted a mock ASCLD/LAB assessment with
recommendations for continuing process improvements.
The physical plant expansion offered opportunities for
more workspace. With expansion, the original space was
reconfigured so that the hard drive recovery team could
build a mini-lab within the lab. This allows for microscopes
and soldering equipment to be set up in a single area with
adequate room to disassemble and repair hard drives for
data recovery. Previously, this equipment was located
in three areas of the laboratory. Conference rooms and
training rooms are at a premium and shared with other
WalMart Stores, Inc. business units, but are carefully managed to ensure that training is afforded on a regular basis.
The following list of spaces is important for Digital
Forensic Labs. Can you tell us a bit about each?
Secure entry and leave your personal cell phone behind: For
security of the Walmart facility and its employee’s privacy, photographs are prohibited. While relinquishing cell
phones is not required, every area of the work space is
monitored by video cameras.
Main exam/workstation area: Each examiner has his or her
own cubicle for conducting examinations. As I mentioned
We identified the core
knowledge, skills, and
abilities that each associate
would be required to establish
to be internally certified as
being competent to conduct