Computer Forensics FAQ
Below are some frequently asked questions about computer forensics. If you can’t find the answer you need here, please feel free to contact us by phone or ask a question with the online form.
Q: What is computer forensics?
A: There are many different definitions for computer forensics. Essentially, the term refers to the collection, preservation, and examination of all forms of digital media. It is a specialized service that provides and documents digital evidence for use in litigation.
A computer forensic investigation is, by nature, highly disciplined, and the results can be proven to be accurate. This is crucial for any digital evidence presented in a court of law.
Q: How does computer forensics differ from data recovery?
A: The goal of our data recovery procedures is solely to recover the files and folders lost due to a computer failure, unintentional deletion, or other unexpected circumstance, without monitoring the usage of the computer.
Data recovery could be considered the first step in gathering evidence in a computer forensics investigation. However, when digital media is imaged (an exact replica of the original), all files and folders are recovered along with deleted data. Engineers can also view hidden or unpartitioned disk areas.
Computer forensics is a service that is concerned with finding evidence (or lack thereof) of computer use. This might include the date, time, and specifics of file access. Investigators are able to find, assemble, analyze, and explain large amounts of digital information that, while not particularly important for the end user, could prove invaluable invaluable in a court of law.
Q: What is eDiscovery?
A: eDiscovery, also known as electronic discovery or e-discovery, is the process of locating and documenting digital evidence from computer hard drives, servers, flash drives, and other digital media.
eDiscovery differs from data recovery because it involves sourcing information that would not be evident from simply viewing a document. For example, an investigation might show access dates and times for a relevant file.
Q: What can you discover?
A: Datarecovery.com can locate any evidence stored on a digital storage device. Examples include deleted emails, deleted chat logs, deleted pictures, hacking evidence, viewed web pages, login times, file MAC (modified, access, created/changed) times, passwords and hundreds of other forensically relevant items.
Because modern computers keep extensive records, the possibilities are effectively limitless. However, this reinforces the importance of a qualified forensics engineer. By employing years of experience, our engineers are able to narrow down the search to pertinent data, improving the objective value of the information.
Q: What costs are implicit in hiring a computer forensic expert?
A: Every case is different, but we provide accurate quotes before beginning work. Call us at 1.800.237.4200 to speak with a computer forensics expert.