-
Computer Forensics
Computer forensics involves the preservation
Learn More
and technical analysis of digital evidence
for the purpose of investigating allegations,
and to objectively report the findings.
-
Forensic Report Writing
Geared for computer forensic examiners
Learn More
who are tasked with writing an expert
witness report and may be called to
testify in trial. -
Cell Phone Forensics
We are able to extract active and deleted data
Learn More
from many cell phones on the market today.
Common engagements include the recovery
of text messages, digital photographs, videos
call history logs, and voicemail.
-
Data Recovery and Analysis
The objective of the computer forensic examiner
Learn More
is to conduct a non-biased analysis of the digital,
evidence which includes the recovery of deleted
data, prepare a well-written, objective report that
contains opinions and the facts to support those
options and testify as an expert witness if needed. -
Litigation Support
In addition to performing the identification,
Learn more
collection, and preservation of digital evidence,
and forensic analysis, we provide a full range of
litigation support services, such as technical
consulting and expert witness testimony.
Innovative, experienced, and thorough - we set the standard.
Experience the difference.
Computer forensics involves the identification, preservation, collection, and analysis of digital evidence. That process may result in documentation for an internal corporate investigation, a declaration for a court proceeding, or findings that may be presented as evidence in court. Whatever the reason, you want to ensure that you start with the right professional who can take your case all the way through to explaining the findings to a jury if necessary.
With the Pixley Forensics Group, your information is in experienced and trusted hands. The Pixley Forensics Group will provide the industry's most complete forensic analysis, litigation support, and advisory services available. We have the expertise and experience to properly handle evidence in criminal and civil cases. We provide computer forensics services to attorneys, corporations, small businesses, government agencies, and private investigators.
-
Informative
-
Targeted
-
Accurate
What is computer forensics?
There is far more information stored on a computer than most people realize. Due to the volume of data, knowing where to look and how to quickly triage a case is important. Even if someone tried to cover their tracks and intentionally delete data, computer forensics can often recover that data.
If you require the services of a computer forensics examiner, you should look for someone who has years of experience, training, and expertise in handling cases and not just someone who claims to be an expert.
The person you select should be trained specifically in computer forensics and not someone who simply majored in computer science as they are two different disciplines. You will want an expert who will be the person handling the analysis and be prepared to testify if necessary.
Take the time to interview potential candidates and do not solely rely on the company that they work for. If your case goes to court, will your expert be qualified? Will the expert stand up to a tough cross-examination? Some questions you should ask are:
- When was the last time you testified?
- How often do you testify?
- What type of formal training have you attended and when?
- What references can you provide from anyone who has seen you testify at trial or deposition?
- Who will actually be doing the work?
The members of the Pixley Forensics Group have provided years of investigative support to local, state, and federal law enforcement agencies. These cases have included child exploitation, homicide, narcotics, counterfeiting, theft, and fraud.
In addition to support, we have been providing formal training to California peace officers through the California Department of Justice since 2001. These classes have included:
- Introduction and Advanced Computer Forensics courses
- Network Investigations
- Internet Investigations
- Mac and Linux Forensics
Since 2004, Bruce Pixley has continued to serve as an expert witness in criminal cases involving computer forensics for the United States Attorney’s Office.
If your agency needs expertise and support of an investigation that involves digital evidence, please contact us. If you are unsure about how to proceed with a new or current case, feel free to call for a no-charge consultation.
As most human resource professionals already know, computers and digital evidence are often involved in HR-related matters, such as claims of wrongful termination, sexual harassment, and discrimination. The digital evidence may involve e-mail, text messages or photos on a cell phone, or files stored on an employee’s computer.
In our work with HR professionals in these types of matters, we found that it is best practice for a company to engage a trained computer forensics expert at the start of their investigation. This will help to ensure the admissibility of evidence and objective analysis if needed at a later proceeding.
We have experience in assisting large corporations and small companies with internal investigations, and matters that involve both pre- and post-termination of employees.
We provide computer forensics services to attorneys, corporations, small businesses, government agencies, and private investigators. Our examiners have experience in testifying in state and federal courts and hold professional certifications specific to the field of computer forensics and investigations.
Identification, Preservation, and Collection
- On-site and remote collection of digital evidence
- Provide solid chain of custody in the collection and storage of evidence
Forensic Analysis
The objective analysis of digital evidence can involve many processes to get to an answer. In our analysis, we use methodologies that are proven and repeatable. Some of these processes include the following:
- Analysis of Internet activity
- Decryption of password-protected files and containers
- Detailed timeline analysis
- Search and analysis of e-mail
- Identification of specific user-related activity
- Extraction of document metadata
- Recovery of user data
- Recovery of data from a damaged hard drive or other storage device
Expert Witness Testimony
As an expert witness, our job is to prepare a well-written, objective report that contains detailed opinions and the supporting facts to support those opinions. Additionally, we have years of teaching experience so we can help the trier of fact to understand the evidence or to determine a fact in issue
In the most simpliest analogy, the computer should be considered a filing cabinet. However, the volume of data that can be stored in that filing cabinet can be overwhelming. One megabyte of storage space is the equivalent to a single book containing 500 double-spaced pages of text. A single gigabyte of storage space, or 1,000 megabytes, is the equivalent of 1,000 books. A hard drive capable of storing 160 gigabytes would be equivalent of 160,000 500-page books. A hard drive purchased today can range up to 4 terabytes!
What type of evidence can be found?
During the analysis phase, our examiners can determine what the computer was used for, what the user looked at, when events occurred, and what the user deleted.
How are deleted files recovered?
Files on a hard drive or other storage media are like the books on a shelf at the library. You find the book on the shelf by using the card catalog. When a file is deleted by someone, the book is not removed from the shelf. However, the card in the card catalog is removed. If the computer needs the space occupied by the book, then the book will be replaced with a new book. Until then, the book can still be picked up and read; in other words, the book is recoverable.
How can the computer be protected from being altered?
The first milestone of any matter is the proper collection and preservation of data. If you have a matter that involves the use of a computer, storage device, or cell phone, you need to take immediate steps to protect it. If someone continues to use the computer, there is a very good chance that relevant data could be altered or deleted files become permanently overwritten. If the computer is off, then leave it off. Allowing anyone to take a peek and look around a bit can cause more harm than good. You will be better served in the long run to engage the services of a computer forensics examiner. Even if you are not ready for any analysis to be conducted, have an examiner properly collect and preserve the data.
The analysis of digital evidence may include the recovery of deleted files or email, searching for specific actions of an individual, and timeline analysis. There is no better way to understand forensics than by reading through some cases. The following scenarios are all based on facts from a variety of cases that we have been involved with over the years.
Client Case Study #1
After leaving employment, a former employee started a new business in direct competition with his former employer. The forensic analysis revealed that prior to leaving his employer, the employee began taking key company information from the company’s server without permission and storing it on a personal hard drive. The employee had tried to cover his tracks by using a personal web-based email account and deleting data from his work computer. After the employee left, he began to use the stolen data in his new business. This evidence was presented to the jury in a civil case and the court ruled in favor of the former employer.Client Case Study #2
A group of five key employees left an employer to start work at a competing company. The company was concerned that the employees may have taken confidential and proprietary information with them.
A forensic examination was conducted of the computers belonging to the former employees. An encrypted chat log was recovered that revealed one former employee had been chatting with an individual at the new employer about exactly what data to take by using a USB thumb drive. Evidence of employees taking the former employer’s data prior to their departure was also discovered. The new employer was confronted with the evidence and the former employer’s data was found located on the new employer’s servers. All five key former employees were quickly terminated and the client's data was returned.
Client Case Study #3
A supervisor was accused of sexual harassment with a subordinate employee. The employee later left employment and filed a sexual harassment lawsuit. The supervisor did not deny the relationship; however, he believed the relationship was based on mutual consent.
The forensic analysis of the former employee’s computer revealed evidence in the deleted iPhone backups, which containing photographs and text messages. This data had been intentionally deleted by the employee prior to departure. The recovered data helped to exonerate the supervisor of any wrong doing and the lawsuit was dismissed.
Data recovery is the process of salvaging data from damaged, failed, or corrupted digital storage media. This may be due to physical damage of the device, such as water or force, or logical damage, such as bad sectors. In either scenario, the end-user cannot access the stored data.
Needless to say, having a good backup routine solves the problem of corrupted data. However, if that backup does not exist, then you can call upon us to handle your data recovery. We have successfully recovered data from hard drives, USB storage devices, optical discs, such as CD’s and DVD’s, and network storage.
Our first step is to conduct a one hour triage of the device in our lab so we can provide you with an assessment of what methods will be required to recover the data.
