Below are some frequently asked questions about computer forensics. If you
can't find the answer you need here, please feel free to contact us by phone or
ask a question with the online form.
A: There are many different "definitions" of computer forensics. Basically,
computer forensics is the collection, preservation, and examination of
all forms of digital media. Computer forensics is a specialized service
that provides and documents digital evidence for use in litigation. A computer
forensic investigation is highly disciplined and the results can be repeated
and proven to be accurate, which is crucial for any digital evidence to be
admissible in court.
Q: How does computer forensics differ from data recovery?
A: The goal of our data recovery procedures is solely to recover the
files and folders lost due to a computer failure, unintentional deletion,
or other unexpected circumstance, without monitoring the usage of the
computer.
Generally, data recovery could be considered the first step in gathering
evidence in a computer forensics investigation. When digital
media is imaged (an exact replica of the original), all files and folders
are recovered along with deleted data. Also, the ability to view any hidden
or unpartitioned space is gained as well.
Computer Forensics is a service that
is concerned with providing evidence (or proving a lack of evidence)
regarding how a computer was used, what files were accessed and at what
time, and who had accessed them. Computer Forensics investigators are
able to find, assemble, analyze, and explain large amounts of digital
information that would not be particularly helpful for data recovery
services, but are invaluable in a court of law.
Q: What is eDiscovery?
A: eDiscovery, also known as electronic discovery or e-discovery,
is the process of searching for, locating, and documenting digital
evidence from digital media such as computer hard drives, servers,
flash drives, etc. e-Discovery differs from simply recovering hard
documents because there is information that may be of importance
that one does not see looking at the document itself.
Q: What can you discover?
A: Deleted emails, deleted chat logs, deleted pictures, hacking
evidence, viewed web pages, login times, file MAC (modified, access,
created/changed) times, various passwords and hundreds of other
forensically relevant items. Because modern computers keep extensive records
of nearly everything they’re used for, the possibilities are effectively
limitless, which is why a trained computer forensic expert is necessary to
narrow a search down to only what is pertinent to the investigation
at hand.
Q: What costs are implicit in hiring a computer forensic expert?
A: Every case is different. Call us at
1.800.237.4200, option #6
to speak with an expert and discuss your specific situation.
