Blog
Preserving Suspect Media (Write Blockers)
When examining or processing the files on a hard drive, it is extremely important to retain the original file contents and time stamps. Many people don’t realize that just connecting a hard drive to a PC will alter the contents of the hard drive. In order to preserve...
Searching for Buried Treasure
Searching and identifying relevant content is a common process for both electronic discovery and computer forensic investigations. But some people don’t realize the challenges associated with indexing hundreds, or even thousands, of different file types and data...
Metadata Analysis – “Fabricated” Documents
One of the common requests we receive is to help a client determine when a document was created, or if it existed at a specific date and time, and when it was last modified. For example, an employment dispute may involve one of the following circumstances: A memo was...
ESI (Electronically Stored Information) Winds of Change
Changes are underway in how electronically stored information (ESI) is processed and reviewed. These changes are due to the huge size of repositories - hundreds of gigabytes or multiple terabyte sizes - identified for collection and processing. Corporations and their...
What does ‘CCE’ Mean?
The CCE (Certified Computer Examiner) is a certification obtained through ‘The International Society of Forensic Computer Examiners’ (ISFCE). I’ve noticed that many CCE training facilities are geared towards criminal investigations so they don’t necessarily address...
When is a Computer Forensic Investigation Needed? (2 of 2)
In my previous post, I identified several primary differences between computer forensic investigations and electronic discovery processing. Next, I’d like to identify some general case categories and tasks that involve a computer forensic investigator. Case...
When is a Computer Forensic Investigation Needed? (1 of 2)
Electronic discovery and computer forensic investigations often go hand in hand. The challenge for many in the legal community is how to identify what ESI (Electronically Stored Information) requires more than typical electronic discovery processing. First, computer...
Recovering Deleted Images
There are three common scenarios in which you may want to recover deleted images: Images accessed from web sites Images downloaded by a user or obtained through file sharing applications Photos stored on a computer hard drive, camera or memory card During a computer...
Encrypted Hard Drive Dangers
You have requested a hard drive clone or image and discover that the contents cannot be culled or reviewed. One reason may be hard drive encryption. Encryption involves ”scrambling” the contents of a file or hard drive so that they cannot be viewed without the...
File Carving – Valuable Remnants Recovered!
Carving files, which can be performed manually or through an automated process, permits the recovery of a portion of a corrupted or deleted file. During a computer investigation, examiners may encounter deleted files that cannot be fully recovered. However, enough of...
Get in Touch with Us
Schedule a FREE demonstration or ask any question. We’d be happy to help.