“Forensics is not ‘simple recovery’… it is the starting point of designing ‘winning logic’”

[Q&A] Attorney Seo-Hyung Lee, Director of Daeryun Forensic Center
“You can track intent beyond the simple fact of access.”

#. Mr. A, the CEO of a marketing agency, visited a law firm to understand the breach of trust method and amount of damage by the PM (project manager) who was suspected of embezzlement. This is because the data Mr. A had was difficult to interpret because it was focused on professional log analysis. He obtained a number of false reports of project labor costs through the law firm Forensic Center's own program and submitted a complaint as evidence.

This is a representative case where a law firm utilized its own forensic capabilities to uncover the true nature of the case. Recently, as information leakage and embezzlement techniques within companies have become more sophisticated and intelligent, the demand for law firm forensic centers that go beyond simple private companies and take into account legal effects is increasing.

Daeryun Digital Forensics Center (Center), launched in 2023, provides solutions in special fields such as personal civil and criminal cases that require high security, corporate internal audit, and embezzlement and breach of trust. It is characterized by the introduction of STT (Speech-to-Text) technology, which automatically converts voice to text, to dramatically shorten the speed of selecting and verifying key evidence from a large amount of data.

On the 3rd, we met with Seohyung Lee, the lawyer who leads the center, to hear about the differences between law firm forensics. He concurrently serves as the head of the Medical Bio Healthcare Group and is a convergence expert who holds pharmacist and patent attorney licenses in addition to being a lawyer. We have handled numerous cases related to corporate disputes and data and personal information.

The following is a Q&A with lawyer Lee.

-Generally, it is often thought that only private forensics companies exist. What are the differentiating features and strengths?
▶Private companies are limited to simple ‘recovery’ of data, but Daeryun is capable of designing ‘winning logic’. This is because the in-house forensic center is at the center, collaborating with lawyers, and identifying the investigative agency's attack points and points of persuasion through tens of thousands of accumulated data. The center goes beyond finding deleted files and analyzes the context of the entire process from data creation to deletion to legally reconstruct them. Our strength is to provide a 'total solution' that combines technology and law to prove the most advantageous facts to the client.

-Recently, the investigation into illegal streaming sites has expanded, causing great anxiety. In these cases, what decisive role does forensic analysis play in determining whether there was intentionality or not?
▶Investigation agencies often conclude suspicions based on access records alone, but forensics is the core of the technical defense to refute this. It goes beyond simple access facts and tracks ‘who connected, why, and how’. For example, it is a method of reconstructing involuntary connections through pop-up advertisements, automatic redirect records, and patterns of termination immediately after connection into a timeline. Through this, it proves that it is a 'passive influx', impeaches the intentionality claimed by the investigative agency, and prevents unfair punishment.

-Managing internal risks such as embezzlement and technology leaks within a company has become important. Considering the special nature of corporate cases, to what specific areas can forensic solutions be utilized?
▶Corporate cases are won or lost depending on how the data is interpreted. Patterns of embezzlement or leakage crimes must be identified and responded to. In the actual marketing agency breach of trust case, it was difficult to prove it with a simple work report, but through PC log analysis, the breach of trust method was proven by capturing the situation of 'ghost personnel' where one person performed work for multiple purposes. On the other hand, in the technology leak case, the system log and hardware characteristics were analyzed against the other party who took issue with large-scale downloading, and the claim was dismissed by proving that it was a 'technical error due to power instability'.

-Is there a case where you cleared a false client or changed the course of a trial?
▶I remember the incident that prevented the crisis of medical license revocation. By establishing an analysis environment with a replica identical to that of the investigative agency, we monitored procedural legitimacy and at the same time demonstrated that the alleged data was generated during normal medical treatment. Even in the absence of the client's device, we reconstructed the 'digital timeline' by finding scattered digital debris such as home PC, family's SNS, and location information. Through this, he proved a perfect alibi at the time of the incident, preventing prosecution and preserving his license.

-Many clients come to us after already submitting their cell phones. What difference does it make if lawyers and forensic experts are brought in together from the early golden hour of the investigation?
▶It is very difficult to reverse the direction of the investigation once established. It is necessary to preoccupy ‘technical issues’ from the search and seizure stage. The defense attorney must first technically correct points that the investigative agency may misunderstand, such as simple access, intentional viewing, backup and leakage, deletion, and use of optimization programs. Therefore, experts within the forensic center immediately block the collection of additional data outside the scope of the warrant and help build a frame that is advantageous to the client from the beginning.

-In a situation where the digital environment such as AI is rapidly changing, what is the goal of Daeryun Digital Forensic Center and the value it wants to promise to its clients?
▶Technology must become the most sophisticated tool to protect individuals from the state’s power of punishment. Daeryun seeks to become a front-line research center and shield against digital threats. By advancing cutting-edge technologies such as deepfake analysis and AI-based voice evidence screening, we will support clients in all areas, including criminal and corporate disputes, as well as inheritance and divorce. We promise to become a ‘digital legal shield’ so that you are not isolated in the digital world.

Reporter Hwang Jeong-won (garden@sidae.com)

[View full article]
"Forensics is not 'simple recovery'... It is the starting point of designing 'winning logic'" (Shortcut)