Acquiring Evidence
Let our knowledge and expertise help you
data collections
Acquiring digital evidence can be a daunting task. Whether its a single email account, cell phone or all of the computers in a large corporation having the right expertise matters. It’s imperative it be collected in a defensible forensic manner. Why does it matter? If a document, email, database or folder can be read, then what is the worry? The worry you should have is admissibility in court.
When using a document in court, it must be authenticated and the method used must be defensible. Meaning, opposing counsel must be convinced nothing has been deleted or altered, including its metadata. When data is not collected in a forensically sound manner, you inherently change the metadata, whether you mean to or not. Once opposing counsel objects because of spoiled metadata, it is out, and sanctions and/or summary judgment on your case can be right around the corner.
The Matters
Potential Sources
Social Media
Social media collections have become more and more relevant in both civil and criminal cases. This is forensically collecting from Facebook, Twitter, Instagram, YouTube, to name a few. Please see our Cloud Accounts collection service page for more info.
Cloud Applications
Cloud applications have changed the way we work. Whether your using Uber to get a ride, AWS EC2 virtual machines to run your business or perhaps GSuite's to host your emails, it has become the norm to collect data from cloud service providers.
Cloud Storage
Cloud storage has become common for most data collection projects. For most individuals and corporations, a substantial amount of information is now stored with third party cloud service providers, such as AWS, Azure, Google and iCloud, etc.
External Storage Devices
External storage devices, also referred to as auxiliary storage and secondary storage, is a device that contains all the addressable data storage that is not inside a computer's main storage or memory. Such as, USB's, flash drives, external hard drives, DVD/CD's.
Mobile Devices
Wheather you have iOS, Andriod or Windows mobile device, we can collect it. This is often times to only source of key evidence such as text messages and call logs, We can also collect from cloud backup services, such as iTunes, iCloud, Google, etc.
Personal Computers
Computers contain a wealth of information beyond the obvious user created files saved on local hard drives. They also contains user history info to prove the who, what, when and how it was used. This key when investigating wrongdoing or proving key facts.
Network Shares
A shared or network drive lets users quickly share files from computer-to-computer. The shared resource most often operates on a Local Access Network (LAN). A shared drive is commonly a NAS, DAS or SAN with multiple drives in a raid configuration.
Servers
A server is a computer program or device that provides functionality for other programs or devices ("clients"). Servers can provide various functionalities, often called "services", such as sharing data or resources among multiple clients, or performing computation for a client.
Collection Types
Physical Forensic Image
A bit-by-bit, sector-by-sector direct copy of a physical storage device, including all files, folders and unallocated, free and slack space. This allows are examiners the ability to perform data recovery and achieve a complete and thorough investigation of all available data.
Logical Forensic Image
A logical image captures all, or a targeted subset, of the active data on a logical partition of a storage device. This active (or visible) data is what would find if you were to browse through the drive with My Computer on Windows or with the Finder on a Mac.
Remote Forensic Collection
Remote Forensics (also identified as Network or Online Forensics) is the collection, examination, and reporting of digital evidence from a connected, operating computer on a live network or accessible via internet access.
Targeted Forensic Collection
Targeted collections are just that, a collection of data performed either onsite or remotely for a specific set of data. This can be done by collecting a set of data by a certain time period, file type or folder for example.
Culled Forensic Collection
Targeted collections are just that, a collection of data performed either onsite or remotely for a specific set of data. This can be done by collecting a set of data by a certain time period, file type or folder for example.
Leading Forensic Experts
Contact us today for a free consultation!