Computer Forensics Services & Process
Identify – Image – Investigate – Inform
What evidence can be recovered from a computer?
• Email: can remain on a computer for years and can be recovered even if deleted.
First and foremost, evidence must be preserved in a forensically sound manner so that it will be admissible. Once properly preserved, evidence can be successfully collected from a computer by making a forensic image. This is a bit-for-bit copy or a mirror image of a computer’s entire memory without disturbing the existing data on the original drive. This process gathers all files, deleted data, file slack, and data in unallocated space for later process and review.
Elements of successful computer imaging include:
• Proper chain of custody policies
The average computer stores hundreds of thousands of files. It can be a daunting task to sort through to recover the pertinent files to review. Proper investigation will sort through to provide you with the proper files.
Information can be found through:
• Recovered deleted files
Whether informing a client, attorney, or jury we use court approved technologies and methodologies to preserve and retrieve data that we stand ready to defend.
• Use forensically sound and court approved methodologies to preserve and retrieve data
Mobile Forensics is an evolving area of electronic evidence collection. Given the number of mobile phone manufacturers and network carriers, the data recoverable will vary from phone to phone. Due to the day to day dependence on these devices, there is always a very good chance that relevant information can be retrieved:
• Text messages
ustrations, Courtroom Graphics and Animations, Demonstrative Evidence, Document Database Consulting, Synchronized Deposition Video, Trial Presentation Systems