|
Computer Forensic and Data Recovery Services
Computer Forensics is the science
and sometimes art of recovering data that is
lost intentionally or accidentally and needs to be recovered and analyzed using
a forensically sound methodology.
In potential civil or criminal cases, it is vitally important that the
individuals performing the forensics examinations have the experience and
certification to recover and analyze the data without modifying the
information and using documented and proven procedures that will stand up in
court.
Just because someone understands computers, doesn't mean they
have the skills to maintain the proper chain of custody documents and
procedures to cause the evidence to be thrown out in court. Likewise,
a highly trained law enforcement officer without the appropriate technical
skills may not realize that simple things like turning on the computer makes
changes to the data on the disk drive that can compromise the evidence and cause
it to be inadmissible in court.
List of Above Board
Consulting's
Computer Forensic and Data Recovery Services
We offer all Phases of Computer Forensic
Investigations
1.
Preservation and storage of evidence as well as duplication of original evidence
to create authenticated images for use in analysis. This step is recommended as
a proactive step in any cases that may potentially involve computer data. This
step is inexpensive and does not require you to complete the following steps if
they are unnecessary.
2.
Analyze the data looking for case specific information depending on the terms of
the engagement or search warrant.
3.
Create a Comprehensive Report on Findings
4.
Secure Storage of all case related material and maintenance of Chain of Custody
documentation
Data Recovery Services
1.
Password Recovery on many file and system types where the password has been
forgotten or is no longer available.
2.
Recovery of
deleted documents, images and emails
3. Recovery of
remnants of documents that were created or printed on a system from unused
space, free-space, temporary files or virtual memory.
4. Recovery of Digital Data from Damaged Hard Drives (such as recovering lost
digital photos that weren't backed up)
Other related services
· Background Checks
Multi or Single State and Federal background investigations for purposes of
employment background checks and other legally allowed investigations
· Fraud Investigations
Investigations of White Collar Crime, Business Fraud and Theft, Corporate
Espionage and Identity Theft and Fraud
· Case Review
We offer case review engagements on cases where electronic evidence has
been presented against your client. This case review will look for possible
violations related to Federal or State Rules of Evidence, issues with the
policies and procedures followed and/or the possibility that the damaging data
may have been created by the examiner. Typical violations include issues with
Chain of Custody, failure to use forensically sound methods to acquire or
analyze the data (Classic case of “Let’s just turn it on and see what’s on
it.”), as well as, more subtle issues such as assumptions based on login names
without any corroborating evidence to prove who was using the login.
Our Basic Computer Forensic Methodology
1.
Preserve the
original evidence
a. Acquire the
original evidence without altering it or changing it in anyway.
b. Duplicate the
original evidence
c. Use forensically
and technically sound methodology to authenticate it’s accuracy against the
original such that it is admissible in court.
2. Analyze the
duplicate authenticated copy of the evidence without modifying the information
and/or creating or deleting any evidence.
3. Prepare and
deliver the final report. Never leave out any evidence that supports or
refutes the case. All relevant evidence must be presented in the final
report.
4. Log the original media, chain of custody documents, copies of evidence, notes
and final report into the safe for storage until needed.
For more information on our computer forensic
methodology and services and what you can expect if you engage our services, go
to Above Board Computer Forensic
Procedures.
Important Forensic Procedures
and Rules Every Firm must follow:
1. Be sure to follow
the State and Federal Rules of Evidence during all phases of the investigation
to make sure that the evidence is admissible in court.
2. “From the Crime
Scene to the Court Room”… maintain strict chain of custody documentation and
keep the evidence secure at all times.
3. Use documented
and tested procedures and policies whenever possible. When deviations are
necessary from the standard policies and procedures, document why you deviated
and be prepared to justify it in court.
Our Forensic
Certifications
| Charlene R. Kessler maintains her
Certified Computer Examiner® (CCE®)
certification from the
International
Association of Forensic Computer Examiners® (ISFCE®)
Her certificate number is 298 and
you will find her name listed among those certified at
http://www.isfce.com/list.htm.
 The
CCE®
certification requirements
- Submit to a background check and have
no criminal record
- Meet training or experience
requirements
- Abide by the
Code of Ethics
- Pass an online proficiency exam
- Demonstrate competence by completing
forensic examinations on three test media cases which are
graded prior to approval
|
|
|
