by admin-jon | Nov 24, 2010 | Blog, Computer Investigations, Electronic Discovery, ESI Collection, Tips & Tricks
A couple weeks ago, I outlined what computer forensics and electronic discovery have in common and how they differ. I’d like to expand on this topic by identifying some common obstacles encountered when using popular computer forensic software for typical electronic...
by admin-jon | Jan 27, 2009 | Blog, Data Recovery, Electronic Discovery, File Recovery, Software, Tips & Tricks
It’s important to understand that deleted email is not recovered or indexed using common litigation support or electronic discovery software. These applications only process email that is still visible within the email software. Some email recovery software can also...
by admin-jon | Nov 21, 2008 | Blog, Collection, Computer Investigations, Data Recovery, File Recovery, Metadata, Software, Tips & Tricks
Copying corporate data and using it at a competing company (intellectual property/corporate asset theft) is a common and serious concern for companies and their legal counsel. When employees leave companies, there are often questions about the security of the...
by admin-jon | Aug 28, 2008 | Blog, Tips & Tricks
The CCE (Certified Computer Examiner) is a certification obtained through ‘The International Society of Forensic Computer Examiners’ (ISFCE). I’ve noticed that many CCE training facilities are geared towards criminal investigations so they don’t necessarily address...
by admin-jon | Aug 21, 2008 | Blog, Collection, Tips & Tricks
You have requested a hard drive clone or image and discover that the contents cannot be culled or reviewed. One reason may be hard drive encryption. Encryption involves ”scrambling” the contents of a file or hard drive so that they cannot be viewed without the...
by admin-jon | Aug 19, 2008 | Blog, Collection, ESI Collection, Software, Tips & Tricks
If you or a partnering service bureau need to be able to process or review your client’s files from an imaged hard drive, you may be in for a surprise. The results of an imaged hard drive are often stored in a forensic image format or what is referred to as an...
