If your opponent’s client uses a computer or if the organization you represent uses computers, you need computer forensics. The computer has invaded our very existence, become a part of our lives, and is an integral part of almost every case from complex litigation and class actions to contract disputes and sexual harassment.
Computer forensics differs from data recovery, which is recovery of data after an event affecting the physical data, such as a hard drive crash. Computer forensics goes much further. Computer forensics is a complete computer examination with analysis as the ultimate goal.
Computer forensics also differs from Electronic Discovery (eDiscovery), as artifacts are usually obtained from computer media that is requested during discovery or obtained through a court order or warrant. Computer forensics analysis is the process of finding evidence that is not readily available and preserving that evidence for admissibility and use in court.
This means not only recovering deleted files (documents, graphics, etc.), but also searching the slack and unallocated space on the hard drive-places where a plethora of evidence regularly resides.
It is tracing artifacts-those tidbits of data left behind by the operating system-for clues of what the computer has been used for, and more importantly, knowing how to find the artifacts and evaluating the value of the information.
Forensic exams allow the processing of hidden files-files that are not visible or accessible to the user-that contain past usage information. It is reconstructing and analyzing the date codes for each file-determining when each file was created, last modified, last accessed and when deleted.
Computer forensics is being able to run a string-search for email, when no email client is obvious. An analysis will reveal Internet usage and recover data, even after the computer has been defragged and/or formatted. It is using industry-standard methodology, and supplying you with a concise, clearly written report.
What can digital forensics do for you?
- In large enterprises, a forensics expert can extract data from databases, emails from email servers and reconstruct data and events from electronic evidence
- A forensic expert can provide attorneys with a wide variety of computer forensics services, such as electronic discovery, data acquisition, data recovery and evidence gathering
- Identifying, recovering, and analyzing digital evidence to prove what happened, when it happened, how it happened and who was involved
- Digital evidence acquisition, search, filter and consolidation of data, emails and files from virtually any type of media, including hard drives, backup tapes, CD-ROM, USB storage devices, smartphones, tablets, Zip disks, and even floppy drives should the need arise
- Finding the optimal balance between legal and technical strategies
- Assistance with depositions
- Expert witness testimony.
Make sure your contracted investigators employ proper, accepted and defensible hardware and software to identify, isolate, and preserve electronic information in a court admissible manner.
Contributed by:
Rick Crouch & Associates offers digital forensic services in civil, criminal and private matters. Rick Crouch & Associates provides complete, non-invasive computer investigation, analysis, recovery, evidence handling and search techniques on computer or network storage media. When performing recoveries for litigation, strict guidelines and protocols are followed to maintain positive control of evidence and content. Additionally, Rick Crouch & Associates provides support for civil and criminal litigation and expert court witnesses for testimonies and depositions.
