Is a technical field that requires a combination of skills including investigations, analytics, evidence handling, computer technology, and communication. It can be your key to discovering the truth, winning a case, or taking appropriate action based on the supporting facts.
- Disk Forensics
- Email Forensics
- Internet Forensics
- Network Forensics
The objective analysis of digital evidence can involve many processes to get to an answer. In our analysis, we use methodologies that are proven and repeatable. Some of these processes include the following:
- Analysis of Internet-related activity
- Decryption of password-proteted files and containers
- Detailed timeline analysis
- Search and analsis of e-mail
- Identification of specific user-related activity
- Extraction of document metadata
- Recovery of user data
- Recovery of data from damaged hard drive or other storage device
- Recovery of data from cell phones and mobile devices
Our job is to prepare a well-written, objective report that contains detailed opinions and the supporting facts to support those opinions. Our examiners have experience in testifying in state and federal courts and hold professional certifications specific to the field of computer forensics and investigations.Additionally, we have years of experience in training profesionals in this technical field, so we can help the trier of fact to understand the evidence or to determine a fact in issue.
Computer forensics involves the preservation and techincal analysis of digital evidence for the purpose of investigating allegations and to objectively report the findings based on supporting facts.
Calling the right person and when
- As most people would agree, calling the right person in to help solve a problem can truly make a different. While some may want to take a do-it-yourself approach as a cost-savings measure, they may not end up with the desired results and end up spending more at the end.
- In some cases, a person may call upon someone in the IT field to assist with the analysis of digital evidence. However, IT staff typically do not have the necessary technical skills to perform investigative activities. From a bigger picture, the IT person needs to consider proper evidence handling, credibility based on investigative experience, being objective, and being prepared to testify as an expert witness if needed.
- Retaining the right computer forensics examiner is critically important. If you stop to think about where your case could go, an impartial third party is the best choice for a forensic expert.
- Computer forensic expertise takes years to develop and requires a range of skills. People who are less skilled may simply overlook key facts, provide findings in a format that is not useful for the investigation or counsel, or have difficulty with effectively communicating findings in an appropriate manner.
- You should start with a proactive approach. You will be better served by calling in a certified forensics examiner at the beginning of your case. Quite often, the examiner is called late into the investigation after people have stepped through the evidence. The examiner is then faced with potential loss of relevant evidence and has to reconstruct the scene to determine the facts.
It is common for cases to involve terabytes of data, especially when a standard hard drive at a retail store ranges from 2 to 4 terbaytes. If you are faced with large volumes of data to sift through, you will be better served by using a computer forensics examiner who has the right tools to get the job done.