|
| |
What is Computer Forensics?
Computer Forensics is the collection,
preservation, analysis, and presentation of computer-related evidence. Computer
evidence can be useful in criminal cases, civil disputes, and human
resources/employment proceedings.
Far more information is retained on a
computer than most people realize. It's also more difficult to completely remove
information than is generally thought. For these reasons (and many more),
computer forensics can often find evidence of, or even completely recover, lost
or deleted information, even if it was intentionally deleted.
Computer forensic investigations are
becoming increasingly useful to corporate security departments worldwide.
Disney & Associates provides computer forensic services to large
corporations, attorneys, law enforcement agencies, insurance companies, and
small businesses. We have the expertise and experience to properly handle
digital evidence in criminal and civil cases and to subsequently provide expert
witness services to corporate and law enforcement clients.
 The gathering of
digital evidence takes specialized tools and personnel trained in specific
techniques to conduct a through analysis of digital media...
Digital evidence can be found in
electronic mail systems, on network servers and on individual employee's
workstations. However, due to the ease with which computer data can be
manipulated, the evidence gathered could likely be dismissed during an
administrative or judicial proceeding if the search and analysis is not
performed by a trained Computer Forensic Specialist.
As computers have become more
prevalent in the business world, employers must safeguard critical business
information. Computers and other digital devices can also contain evidence in
many types of situations, including
-
Employee theft
-
Employee fraud.
-
The theft of proprietary trade
secrets,
-
Allegations of discrimination
-
Wrongful termination claims
-
Sexual harassment suits
Here are a few
of the services that Disney & Associates provides
-
Recovery of accidentally or
intentionally deleted data from standalone PC’s and workstations
-
Detailed investigation of digital
media for evidence recovery in civil and criminal cases
-
Document, E-Mail and financial data
extraction
-
Advanced data recovery, to include
extraction of “hard to find” files from network servers, RAID sets and Network
Attached Storage
-
Complete investigative support to
include the acquisition and analysis of digital media for presentation at a
administrative or judicial proceeding
-
Creation of exact image copies of hard
drives, floppy disks and other digital media for use in a criminal or civil
proceeding
-
Enhanced analysis of audio, video and
graphic files
-
Redaction of undiscoverable (i.e.
privileged) information from documents
-
Expert witness services
-
Documentation and data returned in a
variety of admissible formats (e.g. CD’s, removable disks, tapes, or on paper)
-
Creation of custom investigative reports and PowerPoint® presentations for
courtroom use
Our
computer forensic specialists take steps to identify and attempt to retrieve all
possible evidence that may exist on digital media, whether it is a floppy disk,
smart card, a computer
system or network attached storage.
-
Analysis of the system
-
Listing of all possibly relevant files and discovered file data.
-
Access the contents of password protected or encrypted files.
- Protect the
computer system during the forensic examination against alteration, damage,
data corruption, or virus introduction.
-
Find and record all files on the system. This includes currently active files,
deleted yet remaining files, hidden files, password-protected files, and
encrypted files.
-
Recover deleted files.
-
Reveal the contents of hidden files as well as temporary or swap files used by
both the application programs and the operating system.
-
Analyze all potentially relevant data found in special areas of a disk. This
includes what is called 'unallocated' space on a disk as well as 'slack' space
in a file (partial data from older files still residing in space on a hard
drive that has been allocated to newer files but not used up by it).
-
Provide an opinion of the system layout, the file structures discovered, any
discovered data and authorship information, any attempts to hide, delete,
protect, encrypt information, and anything else that has been discovered and
appears to be relevant to the overall
digital examination.
|
