Data forensics is not the same as "data recovery" such as restoring deleted files or copying files from a backup device, or, using the computer to look at directories, the browser to search for images, documents and other types of files.
If you are seeking these services a local computer technician can likely fulfill your needs, however, don't expect their work to be accepted in any court of law.
Statistics show that 85% of all corporate data is stored electronically, 93% of new data is stored electronically, and approximately 75% of this information is never printed. Consequently, in almost every legal matter, critical and relevant evidence will be stored electronically.
Proper collection and examination of this evidence is critical to avoid spoliation, to preserve the evidence, and to manage cost.
Computer forensics is the methodology used to ensure that electronic evidence is properly acquired and handled, so that it may maintain its evidentiary status.
It is well documented in the media that computer or digital evidence has been the "smoking gun" in many high profile cases. With the majority of new information in businesses of all sizes being created and stored on computer systems, it is undisputable that digital evidence should be considered a primary source of evidence.
CONFIDENTIALITY
All information exchanged between you and UDF is treated with complete confidentiality and respect. All computer data provided to UDF and any other physical media is locked in a protected area accessible only by UDF staff. After our work has been completed you may request that we hold and store all media and work product, return it to you or destroy it. Any items you order destroyed and both logically and physically altered beyond restoration.
The forensic examination computers, networks and systems used by UDF are not connected to the Internet or any other public network thus we are not a target for hackers, worms and viruses common to the Internet, corporate or other public networks. If the data you provide us has worms, trojans or other software of this type it will not affect any investigation or impair the use of our systems in any way.while uncovering evidence.
DATA FORENSIC TOOLS
We have invested in the same, powerful software and hardware tools the FBI, Homeland Security and other law enforcement agencies use in their criminal cases. We are well equipped to provide our clients with state of the art analysis and solid, factual opinions.
We use specialized forensic computer software specifically designed to search, validate and report on evidence and data. Our in-lab analysis work is done in a secure facility to protect the privacy of our clients. All work is carefully documented for use in trial litigation.
The hardware acquisition and software tools are generally accepted in the scientific community and have been upheld in both trial and appellate courts.
TIME IS CRITICAL
When a computer is used, multiple files (unknown to the computer user and not accessible to the average user) are being created, changed and stored. Fragments of E-Mail, word processing, databases, Internet history, picture images. movies and much more remain behind as evidence even after the program is closed or the files are deleted. This hidden or deleted data can often times be recovered and exposed through computer forensics.
If you do not have the passwords to the Email, spreadsheets, databases and other data you want us to search you may request that we crack them in order to access the data.
In situations where the physical disc(s) have errors or appear damaged or unusable we can often times recover all or part of the data.
It is important to begin any computer related investigation immediately.When data is stored in a computer it is placed in what we call "free space". The free space is the same portion of the disc where deleted data (which may contain evidence) may also be recovered. The new data can overwrite the deleted data which may result in evidence never found.
In ongoing investigations, multiple acquisitions of computer data may be desired. UDF can assist you in performing this without the knowledge of the user to continue building your case over a period of time.
EVERY CASE IS DIFFERENT
Investigations typically start when a person, business or law enforcement has a suspicion about unauthorized use of a computing device. In the tangible world a spouse, company manager or detective might only take items specific to what they are looking for right now. Later, as the case unfolds, they realize other files should have initially been taken out of that filing cabinet in the beginning.
Many times you can't go back and obtain this evidence because the contents of computer media have changed, removed or destroyed.
In the computer world, the data stored on the disc itself is intangible, however, the storage media is tangible.
Our approach is to initially "take all of the data" as unwanted data can be excluded in our discovery. If additional search and analysis needs to be performed at a later date we already have all of the data to pull evidence from without wondering if someone permanently altered or deleted the original data at a later date.
EVIDENCE TAINTING
Accusations of evidence tainting are not rare in cases involving computer data when the party who owns or acquires the computer data also analyzes it. Issues such as accessibility to the data by other parties, experience and credentials of the person who acquired and reviewed the data, as well as other questions along these lines are typical.
For the above reasons it's not advisable for a spouse, employer, employee, friend, etc. to perform the function of acquiring and reporting on evidence that has any chance of being litigated.
Professional, third-party companies like UDF are experienced in this type of work and considered neutral and unbiased.
Evidence obtained and submitted by experts like UDF are likely to carry much more weight in front of opposing counsel, corporate management, a jury or any other party.
COST CONSIDERATIONS
If you are thinking about performing this type of work yourself or using your corporate IT department or local computer technician, consider the internal dollar cost and possibility of your evidence and findings being tossed out because of the method in which it was acquired, the qualifications of those who worked on it, or, personal and business associations your friends or staff might have with the subject.
the internal cost is not only the time you or other people spend performing this work but also the time spent in possible depositions, staff moral issues, fall out from gossip spreading and loss of work productivity.
All or some of these may occur and can affect you, your business and most importantly: the outcome of your case or situation.
Often times the cost to use professional, third-party firms like UDF far outweigh the internal costs both in dollars and in winning your case.