Imaging
Imaging is a bit-by-bit replication of the original digital evidence. Our forensic investigators use court approved methods and software in order to capture a forensic image copy (MD5 Hash) of the hard drive. This proven methodology ensures that the output is fully admissible in court as evidence. We are able to copy all forms of active storage media and backups (server, tape, etc.) that could be potential evidence. Using forensically sound tools we are able to in most all cases to view deleted files, printed documents, internet-related files and hidden directories.
Data
Due to the volatile nature of electronic data and the potential for spoliation, our forensic experts will assist with advice on preserving data before the investigation begins. And during the examination, our state of the art forensic tools and processes ensure the examination will be done without compromising the integrity of the data (potential evidence). Often, the type of operating system is key in making important decisions concerning the preservation of the data. It is important to understand that when any device (PC, laptop, etc) starts, operates or suspends, data may be changed, modified or deleted. Before you turn a device on or off, contact us for a no charge consultation.