What does ‘CCE’ Mean?

The CCE (Certified Computer Examiner) is a certification obtained through ‘The International Society of Forensic Computer Examiners’ (ISFCE). I’ve noticed that many CCE training facilities are geared towards criminal investigations so they don’t necessarily address civil litigation processes and ESI (Electronically Stored Information) requirements. This is because the CCE was...

read more

When is a Computer Forensic Investigation Needed? (2 of 2)

 In my previous post, I identified several primary differences between computer forensic investigations and electronic discovery processing. Next, I’d like to identify some general case categories and tasks that involve a computer forensic investigator. Case Categories: ·    Employment disputes ·    Misuse of company computer involving pornography, gambling, blackmail and fraud...

read more

When is a Computer Forensic Investigation Needed? (1 of 2)

Electronic discovery and computer forensic investigations often go hand in hand. The challenge for many in the legal community is how to identify what ESI (Electronically Stored Information) requires more than typical electronic discovery processing. First, computer investigations are technically electronic discovery, and the line between the two disciplines will...

read more

Encrypted Hard Drive Dangers

You have requested a hard drive clone or image and discover that the contents cannot be culled or reviewed. One reason may be hard drive encryption. Encryption involves ”scrambling” the contents of a file or hard drive so that they cannot be viewed without the appropriate key or password. To...

read more

File Carving – Valuable Remnants Recovered!

Carving files, which can be performed manually or through an automated process, permits the recovery of a portion of a corrupted or deleted file. During a computer investigation, examiners may encounter deleted files that cannot be fully recovered. However, enough of the file may still be intact and worth restoring....

read more

Imaging Hard Drives – Will you get what you expect?

If you or a partnering service bureau need to be able to process or review your client’s files from an imaged hard drive, you may be in for a surprise. The results of an imaged hard drive are often stored in a forensic image format or what is referred to...

read more

Recovering deleted files (3 of 3)

To recover deleted files, user activity logs, Internet history, and other potentially relevant custodian information, a ‘physical’ copy or forensic image of the hard drive or other media is required. Creating a physical copy or forensic image preserves the entire contents of the media, and makes it possible to recover...

read more

Pinpoint Labs