Computer forensics analysis is becoming increasingly useful to businesses. Computers can contain evidence in many types of human resources proceedings, including sexual harassment suits, allegations of discrimination, wrongful termination claims, and others. Evidence can be found in electronic mail systems, on network servers, and on individual employee's computers. However, due to the ease with which computer data can be manipulated, if the search and analysis is not performed by a trained computer forensics examiners, it may not be allowed in court.

Qualifications

When you require the services of a computer forensics specialist, don't be afraid to shop around. There are an increasing number of people who claim to be experts in the field. Look very carefully at the level of experience of the individuals involved. There is far more to proper computer forensic analysis than the ability to retrieve data, especially when a case may go to court.

The bottom line is you will be retaining the services of an individual that may be called to testify in court to explain what he or she did to the computer and its data. The court will want to hear that individual's own level of training and experience, not the experience of their employer. Make sure you find someone who not only has the expertise and experience, but someone who will stand up to the scrutiny and pressure of cross examination.

We use active and retired law enforcement officers to conduct computer forensics examinations for law enforcement agencies, attorneys, private investigators, businesses and private individuals. We have the expertise and experience to properly handle evidence in criminal and civil cases.

Digital Evidence

Electronic data includes any record, file, source code, program, computer manufacturer specifications, and other imprint on a computer storage device. Because of the almost limitless application of computers in our society, electronic evidence takes many forms. It can encompass sensitive word processing documents, personnel records, customer lists, financial information, e-mail routed via the internet and local intranets, electronic scheduling systems, computer operation logs, and voice mail transcriptions, whether or not they are transferred to a printed page.

Did you know that in many cases "deleted" evidence that is needed to make or break a case is still on the hard drive? Retrieving it, however, requires skill and expertise in data recovery. Our experts can safely enter any microcomputer system, network, or data storage device to recover data and determine whether it has been tampered with, deleted, or damaged. Depending on your particular situation, our experts can search for specific data (such as phrases, files, numbers, or keywords), analyze and determine what different file dates may mean, or verify illegal use of proprietary information.

Password protected files? Not a problem for Disk Detectives.com. We use proprietary software to crack passwords.

What should you do?

Computers that are suspected to have been involved in illegal or improper activity must be treated like evidence from the moment you suspect something. These guidelines will help make sure that a qualified computer forensic examiner can retrieve the electronic evidence you need to make your case.

1) STOP USING THE COMPUTER INVOLVED IMMEDIATELY! This is the most important thing you can do to ensure the preservation of evidence. Continuing to use a suspect computer beyond the time of the suspected incident will contaminate the "crime scene" and may result in damage or destruction of data as well as seriously affect the admissibility of digital evidence.

2) PHYSICALLY RESTRICT ACCESS TO THE COMPUTER. Place the computer in a locked office or closet until they can be examined by a qualified forensic examiner. Document who secured the equipment and who has the keys to the room.

3) DO NOT ATTEMPT TO EXAMINE OR RETRIEVE DATA FROM THE COMPUTER INVOLVED. You know your data better than anyone else, but booting up the system or logging on to see what happened may actually damage or destroy the very data you need to make your case. Such as changing last accessed times.


4) DO NOT INSTALL ANY SOFTWARE TO RETRIEVE DATA. - Installing any software, even to undelete files, will overwrite and destroy valuable data on your computer.

5) CONTACT A QUALIFIED COMPUTER FORENSIC EXAMINER. - As soon as you suspect
that you have a problem and have secured the equipment involved, you'll need a specialist to help you determine if you need an investigation, and if so how far to take it. Unfortunately, many people in this business will buy some software and call themselves "professionals," so make sure that the ones you call have the expertise and experience to find the evidence you need to win your case.