Frequently Asked Questions
What is Digital Forensics?
Digital Forensics is the acquisition and analysis of digital evidence in a forensically sound manner. This includes preservation of original media, analysis of evidence and its context, and the proper treatment of digital evidence so that it stands up in court.
When can Digital Evidence be used?
Digital Evidence is being utilized in more and more administrative, civil, and criminal investigations. This includes divorce, administrative cases involving mis-use of computers and/or the network, defamation, sexual harassment, data theft, and industrial espionage.
Where can Digital Evidence be found?
Digital evidence can be found in a number of different places, not just computer hard drives. In addition to hard drives, computer evidence can also be found on Cell Phone, MP3 Players, Tapes, CDs, Printers, PDAs, Memory Sticks, Camera Cards, and Network Logs.
What Digital Evidence can be found?
In addition to files listed in a standard directory search, digital evidence can also include Hidden Files, Deleted Files, Email, Deleted Email, Passwords, Logs, Login IDs, Encrypted Files, Stegged Files, Web Sites Visited, Searches Performed, Cookies, Network Traces. Many of these sources include time information, which helps build time lines in investigations.
Can you help me compose an e-discovery request?
Yes. We can help determine the correct scope and help to assure that no important discovery avenues are omitted.
What causes digital evidence to be inadmissible?
The courts have adopted very strict rules on how digital evidence must be handled to avoid the appearance of tampering. A trained digital forensics specialist, such as our staff, should be used.
Can you recover deleted files?
Very often, yes. We have special software that can find deleted files that often remain on drives for quite some time after they have been "deleted".
Can you view password-protected files?
Very often, yes. We have techniques to circumvent or crack some password protection and some forms of encryption.
Can you recover files from failed drives?
Very often, yes. Many failed drives still have data that can be obtained by our software and techniques.
Can you uncover emails?
Very often, yes. Emails are stored in files that our software can find and view. Also, we can help you obtain email from email servers.
Can you uncover instant messages?
Very often, no. Most instant messaging is hard to recover.
Can you find out what web sites were visited?
Very often, yes. There are several places on a computer that keep data on web activity.
What tools do you use to uncover this information?
Our lab is equipped with the most up to date forensics hardware and software including EnCase Forensic Edition and The Forensics Tool Kit (FTK).