Computer Forensics

Computer Forensics FAQ

Below are some frequently asked questions about computer forensics. If you can’t find the answer you need here, please feel free to contact us by phone or ask a question with the online form.

Q: What is computer forensics?

A: There are many different definitions for computer forensics. Essentially, the term refers to the collection, preservation, and examination of all forms of digital media. It is a specialized service that provides and documents digital evidence for use in litigation.

A computer forensic investigation is, by nature, highly disciplined, and the results can be proven to be accurate.  This is crucial for any digital evidence presented in a court of law.

Q: How does computer forensics differ from data recovery?

A: The goal of our data recovery procedures is solely to recover the files and folders lost due to a computer failure, unintentional deletion, or other unexpected circumstance, without monitoring the usage of the computer.

Data recovery could be considered the first step in gathering evidence in a computer forensics investigation. However, when digital media is imaged (an exact replica of the original), all files and folders are recovered along with deleted data.  Engineers can also view hidden or unpartitioned disk areas.

Computer forensics is a service that is concerned with finding evidence (or lack thereof) of computer use.  This might include the date, time, and specifics of file access. Investigators are able to find, assemble, analyze, and explain large amounts of digital information that, while not particularly important for the end user, could prove invaluable invaluable in a court of law.

Q: What is eDiscovery?

A: eDiscovery, also known as electronic discovery or e-discovery, is the process of locating and documenting digital evidence from computer hard drives, servers, flash drives, and other digital media.

eDiscovery differs from data recovery because it involves sourcing information that would not be evident from simply viewing a document.  For example, an investigation might show access dates and times for a relevant file.

Q: What can you discover?

A: Datarecovery.com can locate any evidence stored on a digital storage device.  Examples include deleted emails, deleted chat logs, deleted pictures, hacking evidence, viewed web pages, login times, file MAC (modified, access, created/changed) times, passwords and hundreds of other forensically relevant items.

Because modern computers keep extensive records, the possibilities are effectively limitless.  However, this reinforces the importance of a qualified forensics engineer.  By employing years of experience, our engineers are able to narrow down the search to pertinent data, improving the objective value of the information.

Q: What costs are implicit in hiring a computer forensic expert?

A: Every case is different, but we provide accurate quotes before beginning work. Call us at 1.800.237.4200 to speak with a computer forensics expert.

Can a Cell Phone Contain Evidence?

In the course of an investigation, you may need to prove that an individual made a call, sent a text message, or read an email.  If you have access to the individual’s smartphone, you have the ability to discover and present this information as evidence – but if you’re not a certified forensic examiner, a misguided attempt to collect that information could have lasting consequences.

Datarecovery.com provides the cell phone computer forensics and electronic discovery services that you need to present a compelling case.  Our engineers can work with any brand or model of cell phone, recovering deleted data and collecting access information that could prove invaluable in court.  We keep chain of custody reports while performing our services, and our forensic examiners are fully qualified to perform electronic discovery on mobile devices (including all smartphones, tablets, electronic planners, and even digital audio players).

Secure Facilities with Comprehensive Electronic Discovery Capabilities

Datarecovery.com is a leader in the field of forensic cell phone data recovery technology, and we have offered recovery services for all brands of cell phones since 1998.

Each of our locations is equipped with a capable data recovery laboratory, and our superior security standards help to keep your case moving forward.  Our engineering teams have decades of experience with cell phone data recovery, and we are at the forefront of our industry in terms of research and development.  Our investments allow our engineers to access new cell phone interfaces and develop innovative recovery and electronic discovery techniques.

What Can Be Recovered From A Cell Phone?

Datarecovery.com’s engineers can recover data regardless of scenario, operating system, or smartphone brand.  When performing electronic discovery services on phones, we utilize cutting-edge methods to locate any and all information that could influence the case in question.  This can include:

• Deleted Text Messages – Deleted messages are either stored on the phone’s SIM card or flash memory. This data is not permanently destroyed upon deletion, and a knowledgeable engineer can work with data on a bit level to recover individual messages along with associated information.
• Pictures – On modern smartphones, photographs are relatively large files.  Data corruption can be a serious problem when files are intentionally destroyed. Our engineers use new proprietary data recovery techniques to completely reconstruct each picture, providing our clients with a full, perfect copy of each digital image, and our computer forensics specialists can prove the date and time of each photograph with complete certainty.
• Phone Call Information – Phone logs are typically stored in a small area that varies in location according to the cell phone or smartphone’s operating system.  We can access this information instantly, providing appropriate controls along with a full chain of custody report.
• Other Types of Stored Data – Modern smart phones are capable of holding gigabytes of information, everything from documents to video and music. All of this information is recoverable, even after formatting and even when the cell phone itself will not power on.

Datarecovery.com can retrieve any missing or inaccessible information from any cell phone manufacturer, sometimes within several hours, and our forensic experts can guide you through the process.  We also offer standard smartphone data recovery services for non-forensic situations.

To get started, contact an engineer today at 1.800.237.4200.

Contact

If you need immediate assistance, you can contact one of our computer forensics examiners by calling 1.800.237.4200.

You can also send a message to one of our experts using the form below.

Our Process

By nature, computer forensics services need to be customized for every individual case.  Datarecovery.com’s engineers follow an established process to control costs and to identify potential evidence as efficiently as possible, and each case proceeds through the following stages:

Consulting – A trained consultant will discuss computer forensics with you, collecting basic information about your case in order to develop an initial strategy.
Datarecovery.com’s specialists regularly perform work for large businesses and personal computer users, and they can quickly identify the most likely locations for key evidence.  When necessary, we can also recover files that have been lost, deleted, or intentionally destroyed.

If file recovery is not an option, we can recover fragments of files or access user information that could prove invaluable in litigation and other legal proceedings.  After the initial consultation, you will receive a detailed quote that outlines the cost of the proposed services.  If you approve this quote, we can begin work immediately.

Data Collection – At this point, Datarecovery.com’s computer forensics specialists can receive your media and begin data recovery and electronic discovery procedures.  You can transfer your media to Datarecovery.com via FedEx or another shipping carrier; alternately, you can deliver media directly to one of our full-service laboratories.

We maintain a full chain of custody report for your benefit.  Your media is protected at all times, and we offer unsurpassed data security.

Reporting – Our computer forensics specialists will produce reports, depending on your needs and the specific characteristics of the case.  The length of our written reports can vary, but we always provide sufficient information including (where applicable) the location of key files, access times, user information, examples of intentional deletion, and other key evidence.

Expert Testimony – Our forensic investigators can support your case via expert witness testimony.  This helps to establish the importance of the discovered evidence in some cases; speak with one of our consultants for more information.

To get started, call 1.800.237.4200 now and ask for a member of our computer forensics team.

What We Can Find

Even if you’re an experienced legal professional, electronic evidence can be overwhelming. The field has expanded considerably thanks to innovative technologies – some of which were developed in Datarecovery.com’s research laboratories – and modern forensic specialists have incredible tools at their disposal.

Our electronic discovery capabilities are only limited by the physical condition of your media. We can recover data from damaged hard drives, return deleted files to a working state, and locate the exact source of viruses and malicious software. This allows you to access lost information that could aid in litigation, defense, or even in criminal prosecutions.

More importantly, our specialists know how to search for specific data sets in order to find viable evidence. We can look for key phrases, create logs of user actions, establish login and logout times for certain applications, and take other relevant steps to find pertinent information.

We use tools that are proven to be effective in court, and our engineers follow appropriate precautions to maintain a clear chain of custody. You will provide essential guidance for our experts, and because we work closely with our clients, you’ll stay updated as the case progresses. Datarecovery.com will find any supporting evidence that exists on your media, and you’ll benefit from our extensive track record in the field of electronic discovery.

Our services begin with an initial consultation, which will help to determine whether computer forensics are an appropriate or effective option for your situation. Get started by calling 1.800.237.4200 to speak with an engineer.

eDiscovery

Electronic discovery (or eDiscovery) is the process of locating evidence on a hard drive or other digital medium.

When performed by a trained forensic professional, electronic discovery can be an extremely beneficial tool. Datarecovery.com’s specialists can perform an intensive search, locating computer login records, user passwords, file access times, signs of malicious attacks, and other evidence without altering computer media – an important factor when establishing the legal validity of the discovered information.

Our engineers have dozens of years of combined experience with electronic discovery. They have performed work on countless hard drives, servers, cell phones, and other media, and we utilize the latest forensic technologies for the best possible results.

To discuss an electronic discovery case, contact a computer forensic engineer today at 1.800.237.4200.

Chain Of Custody

A chain of custody is chronological documentation for evidence in a particular case. It is especially important with electronic evidence due to the possibility of fraudulent data alteration, deletion, or creation.

In electronic discovery and computer forensics, you need a fully detailed chain of custody report in order to show the physical custody of a piece of evidence and show that all parties that had access to said evidence at any given time.

Datarecovery.com offers chain of custody reports for all computer forensic cases, and we strongly recommend keeping these documents for all types of legal proceedings. If you have questions about chain of custody or if you would like to set up a consultation, call us today at 1.800.237.4200.