Digital Forensics
We have the expertise to analyze data and determine when it was created, when it was deleted, when it was manipulated, if it contains certain content, if it is consistent with other data, if it has been altered, etc. and to catalog any pertinent information. We can also determine if data has been purposefully obfuscated or erased. Our methods and tools have been proven to stand up in court. We offer a free initial consultation to help our clients determine their specific Digital Forensic needs.
Digital Forensics or Digital Forensic Science is the retrieval, storage, and analysis of Electronically Stored Information (ESI) to produce evidence and expert conclusions in a manner that will be admissible and defensible in court. Digital Forensic practitioners have come to favor this term over Computer Forensics because of the occasional incorrect assumption that Computer Forensics only applies to personal computers. Digital Forensics and Computer Forensics involve any electronic device that stores information. Such devices include computer systems, servers, smart phones, dumb phones, GPS systems, tablets, gaming consoles, appliances, and much more.
While digital forensics aims to produce results to the high standards of the legal system, private individuals often want to employ the services of a digital forensic practitioner to ensure they receive the most complete and accurate information. Unfortunately, there are many IT firms and computer technicians who claim to be digital forensic analysts or such, but have no formal training or experience. When you hire a digital forensic technician, make sure you check their credentials and background. For more information about what to look for when hiring a digital forensic expert, please see our About Us page.
Every Digital Forensic Case is different. Most cases include some or all of the following steps:
Consultation - Discussion with the client to help determine a strategy for their case. Often, review of the discovery and other documents in the case are performed prior to meeting with the client. Typically, these early stages of the Digital Forensic process are when preservation letters, protective orders, etc. are drafted and put in place.
Acquisition - Creation and secure storage of bit-stream image(s) of the data from the evidence media. Bit-stream images are exact duplicates of every bit of data on a given media, such as a hard disk drive, USB drive, or cell phone storage. The creation of the bit-stream images also serves as preservation of the evidence.
Electronic Discovery - Production of electronically stored information (ESI) based on some protocol. This protocol could specify key word searches, date ranges, authors, etc. Typically, the results are checked for confidentiality by the media's custodian before being disclosed to the opposing party. Results often contain data that was previously deleted. The recovery of deleted data is performed utilizing the most sophisticated tools and robust methods.
Analysis - Thorough and detailed examination of the ESI is performed to construct an expert conclusion. Often, timelines of events or document revisions can be created. State of the art tools and techniques are employed to ensure the validity of the results.
Reporting - Formal and professional written reports of the expert's findings are created. The expert's reports are carefully crafted to explain complex technical details in ways even the least technically sophisticated people can understand.
Testimony - In court testimony and/or depositions are given.
The highest professional standards, as recognized and mandated by the International Society of Forensic Computer Examiners®, are followed in all our work. Please see our Rates page for explanations of the costs for digital forensic services.