Reporting & Testimony
Let our knowledge and expertise help you
Documenting The Facts
ESICloud’s computer forensic investigations typically involve the analysis of electronic devices and data to prove or disprove – Destruction, Ownership, Possession, Tampering, Security Breaches, Timelines, User Activities or just plain old theft of trade secrets, confidential information and/or intellectual property.
As part of the process of analyzing electronic data and devices, investigations necessitate the proper preservation and collection of evidence, so that it can be properly introduced into evidence at legal proceedings. Further, proper reporting processes must be conducted to accurately present this information in a usable and comprehensible format.
ESICloud’s forensic team has over 20 years of experience consulting, collecting and analyzing electronic devices & data.
Our Process
Our investigators use a variety of techniques and proprietary forensic software applications to examine digital evidence. Using verified copies of evidence, our investigators perform searches against evidence, including hidden files, folders, and unallocated disk space for copies of deleted, encrypted, or damaged files. We may also perform searches using sophisticated algorithms or process data using advanced analytics and artificial intelligence to identify a nexus between patterns and data relations. Any evidence found is carefully documented in a “finding report” and verified in preparation for legal proceedings that involve discovery, depositions, or actual litigation.
Types of Reports
As an example, a typical investigation may involve running searches and examining resulting reports relating to:
A listing of search and browse history of adult websites
A listing of all attached devices, including storage media type, make, model & serial number
A listing of all files containing bank account numbers
A detailed list of all cell phone calls, including dates, times, phone numbers, contact names, incoming or outgoing
A detailed list of cell phone towers used, including dates and times
A listing of all available chat sessions
A listing of all known files on the national child exploitation registry
A search result listing of all files containing credit card numbers
A search result listing all files mentioning legal and/or illegal known substances by proper and street names
A search result of all used email accounts by suspect
A search result of all identifiable email address
A listing of all encrypted and password protected files
A complete listing of all available EXIF metadata from all relevant files
All active and deleted files from targeted device, including system metadata and HASH
A detailed report of all GPS information from all available sources
All internet history, including URL’s, dates & times
A timeline indicating what, when, how often and number of times an application was running
All recently opened and accessed documents
Recovery and analysis of all INFO2 recycle bin data to identify previously deleted files
A search result listing of all files containing social security numbers
Key OS system information & application listing
A search result of all files containing content or references to terrorism based on Homeland Security search criteria
A listing of all or select text messages
A timeline report based upon specific criteria
Key user profile information
Collection Types
Physical Forensic Image
A bit-by-bit, sector-by-sector direct copy of a physical storage device, including all files, folders and unallocated, free and slack space. This allows are examiners the ability to perform data recovery and achieve a complete and thorough investigation of all available data.
Logical Forensic Image
A logical image captures all, or a targeted subset, of the active data on a logical partition of a storage device. This active (or visible) data is what would find if you were to browse through the drive with My Computer on Windows or with the Finder on a Mac.
Remote Forensic Collection
Remote Forensics (also identified as Network or Online Forensics) is the collection, examination, and reporting of digital evidence from a connected, operating computer on a live network or accessible via internet access.
Targeted Forensic Collection
Targeted collections are just that, a collection of data performed either onsite or remotely for a specific set of data. This can be done by collecting a set of data by a certain time period, file type or folder for example.
Culled Forensic Collection
Targeted collections are just that, a collection of data performed either onsite or remotely for a specific set of data. This can be done by collecting a set of data by a certain time period, file type or folder for example.
Leading Forensic Experts
Contact us today for a free consultation!