Forensic Data Acquisition

What do you see here?

01001001 00100000 01100100 01101001 01100100 00100000 01110100 01101000 01100101 00100000 01100011 01110010 01101001 01101101 01100101

We see the evidence necessary for you to win your case.

Computers are more common in offices today than copy machines. And more than 95% of data are stored electronically, not in file cabinets.

It used to be that evidence was found on paper. Maybe it was a report, maybe it was a passing comment or maybe it was a corporate communication, but it was always in paper form. You could pick up the evidence, hold it in your hand, put it on another attorney's desk, and nothing about the evidence would change. But that's no longer the case, is it?

Times are changing

The mere act of powering on a computer can very easily destroy whatever evidence you may have had on the computer. Digital evidence requires a different handling than paper documents, you have to follow forensic procedures to ensure the integrity of the data.

You no longer have the luxury of being able to thumb through a box of documents and examine them in your search for relevant documents. Digital data requires a special processing to make sure the data remains intact and defensible. If you attempt to find documents on your own you will end up most certainly altering the data, especially the "last accessed date." This information is crucial to your case and steps must be taken to avoid altering this data.

This might sound terribly difficult or inconvenient but exercising precautions and calling in forensic professionals to perform a data acquisition will save you a considerable amount of time. To see how these actions can save you time and money have a further look at our keyword searching, digital document repository as well as our online document hosting.

Copy or drag-n-drop vs forensic acquisition. Evidence spoliation occurs when you "copy" or "drag-n-drop" electronic data. Both of these methods change the metadata and will potentially destroy crucial evidence. Simply turning on a computer or viewing an electronic file changes the metadata.

We protect your data. Our computer forensics professionals will ensure that suspect computer data is carefully handled to avoid spoliation and to certify a defensible chain of custody. We use forensically proven methods to acquire electronic data and ensure that:

• We strictly adhere to standard operating procedures.
• No evidence is damaged, changed or otherwise compromised.
• Extracted relevant evidence is properly handled and protected from computer viruses.
• A defensible chain of custody is established and maintained, to which we will testify.

Malicious vs accidental... it doesn't matter! Regardless of the reason, data can get lost, deleted or stolen. An immediate forensic acquisition greatly increases the ability to recover or track all missing electronic files. Any computer activity contributes to overwriting missing data.