Call Us 888-304-1096


What are File Headers? (Signatures)

Many file types can be identified by using what’s known as a file header. A file header is a ‘signature’ placed at the beginning of a file, so the operating system and other software know what to do with the following contents. Many electronic discovery applications...

read more

Recovering deleted files (3 of 3)

To recover deleted files, user activity logs, Internet history, and other potentially relevant custodian information, a 'physical' copy or forensic image of the hard drive or other media is required. Creating a physical copy or forensic image preserves the entire...

read more

Recovering deleted files (2 of 3)

It often comes as a shock to attorneys and their staff when they hear that electronic discovery processing doesn't automatically search the entire contents of a custodian’s hard drive. So, it’s worth stating again for emphasis here. Common electronic discovery...

read more

Recovering deleted files (1 of 3)

In my last post, I pointed out that in the case of the BTK killer in Kansas, investigators recovered a deleted Microsoft Office document that contained evidence crucial to the case. There are still many litigation support professionals who don't thoroughly understand...

read more

Great question in an email today…

A client asked me if it was possible to determine if a custodian did copy files from their server to an external USB flash drive. The USB drive isn't available, so they wanted to know if Microsoft Windows tracks where files are copied. Now, you would think that with...

read more

Get in Touch with Us

Schedule a FREE demonstration or ask any question. We’d be happy to help.

  • This field is for validation purposes and should be left unchanged.