Computer Forensics Services & Process

Identify – Image – Investigate – Inform

Identify

What evidence can be recovered from a computer?

• Email: can remain on a computer for years and can be recovered even if deleted.
• Internet Activity: Web pages leave virtual footprints that can be analyzed to create a timeline of visited web sites
• Computer Usage History – our team can also determine specific computer programs downloaded and executed, including any malware programs such as data wiping software, keyloggers or remote access programs.
• Documents, spreadsheets, PDFs, pictures, videos, and anything saved or written to the computer’s hard drive.

Image

First and foremost, evidence must be preserved in a forensically sound manner so that it will be admissible. Once properly preserved, evidence can be successfully collected from a computer by making a forensic image. This is a bit-for-bit copy or a mirror image of a computer’s entire memory without disturbing the existing data on the original drive. This process gathers all files, deleted data, file slack, and data in unallocated space for later process and review.

Elements of successful computer imaging include:

• Proper chain of custody policies
• Forensically sound tools
• Court accepted procedures

Investigate

The average computer stores hundreds of thousands of files. It can be a daunting task to sort through to recover the pertinent files to review. Proper investigation will sort through to provide you with the proper files.

Information can be found through:

• Recovered deleted files
• Text recognition
• Keyword and concept searches

Inform

Whether informing a client, attorney, or jury we use court approved technologies and methodologies to preserve and retrieve data that we stand ready to defend.

• Use forensically sound and court approved methodologies to preserve and retrieve data
• Produce an audit report to identify the actions taken and show compliance with acceptable computer forensic technologies and methodologies
• Provide the actual files for the parties to review for their case with all metadata and relevant information intact

Mobile Forensics

Mobile Forensics is an evolving area of electronic evidence collection. Given the number of mobile phone manufacturers and network carriers, the data recoverable will vary from phone to phone. Due to the day to day dependence on these devices, there is always a very good chance that relevant information can be retrieved:

• Text messages
• Call logs
• Emails
• Pictures
• Internet History
• Contacts
• Location and Cell Site Analysis

ustrations, Courtroom Graphics and Animations, Demonstrative Evidence, Document Database Consulting, Synchronized Deposition Video, Trial Presentation Systems