Computer forensics

COMPUTER FORENSIC SERVICES:

Intellectual Property Theft

Social Media and the Cloud

Email Reconstruction and Relationship Analysis Services

Review Services

Digital Evidence Acquisition

Covert & Remote Collections

Picture & Video File Review

Cell Phone Forensics

Internet History Reconstruction

Computer Timeline Analysis

Keyword Searching

Email & Chat Recovery/Analysis

Metadata Extraction/Analysis

Password & Data Recovery

Live Host & RAM Analysis

Expert Witness Services

THE PROCESS

Our examiners devise and execute focused analysis strategies that are tailored to the specific requirements of each client. You will have experts working on all phases of the computer forensic process – identification, preservation, examination and documentation.

The identification Phase

Our professionals work with the client to gain a thorough understanding of the target environment and consider all sources of data – including:

Local storage media (hard drives, CD/DVD’s, flash drives, etc.)

Volatile data (system RAM, ARP tables, active device configurations, etc.)

Network perimeter logs (Firewall, Web Content Filtering, VPN, etc.)

Server and devices logs

Cellular phones and PDA’s

Digital cameras, DVR systems and gaming consoles

The preservation phase

We collect and authenticate your digital evidence. It is important that potential digital evidence is properly preserved and verified for admission in legal proceedings. Our examiners will perform the appropriate acquisitions. Some methods include:

Static forensic imaging of systems and media that have been powered down

“Live” imaging or data collection from running systems

Lawful intercept and collection of data in transit (packet capture)

Covert (or “black bag”) media imaging and data collection

Remote network acquisition of storage devices or file level data

The examination phase

This is where results are realized. Our examiners perform advanced analyses and expert interpretation of findings. The following represents a few of the many tasks that can be accomplished by a skilled forensic computer examiner:

Recover deleted or purposely hidden files

Determine the source and/or authenticity of electronic communications

Reconstruct a sequence of events performed on a computer system – even when measures have been taken to conceal these activities

Search allocated, unallocated, slack, and hidden areas of computer storage media to locate key words, phrases, and file types

Recover and track electronic correspondence such as e-mail, chat, and instant messages

Identify Internet activity such as browsing habits, file transfers, and newsgroup participation

During the presentation phase, examination findings are produced and/or communicated. Deliverables may include:

Expert report

Client consultation

Export of files in native format

Export of files in human readable form (PDF, TIFF, printed to paper, etc.)

Testimony

Get Started

CELL PHONE FORENSICS

Cell phone forensics