Digital Forensics

Digital forensics is the application of investigation and analysis techniques to gather and preserve evidence from computing device or system in a way that is suitable for presentation in a court of law. Our digital forensics team uses a structured investigation approach while maintaining a documented chain of evidence to find out exactly what happened on a computer system and who was responsible for it.  From acquisition to courtroom presentation, we provide deep expertise to provide clarity to the most complex of technical matters.

Identification – When a security incidence or criminal activity occurs, first responders need to know where relevant date may be stored. For digital investigations, this may include obvious systems such as smart phones, laptop computers, and corporate networks. Critical data may also be stored in less obvious devices, such as CCTV systems, vehicle navigation systems, or Apple watches. Every incident is different, and we are always available to provide over the phone or email guidance to help identify potential digital evidence

Preservation - Potential data sources must be isolated, secured, and preserved. This includes preventing people from possibly tampering with the evidence. In today’s connected world, the foremost challenge is isolating the data from remote tampering or deletion.  Smartphones are contantly communicating with their service providers even when not being actively used. Networks and cloud environments are constantly moving data. Our forensic professionals can provide techniques and tools to quickly isolate and preserve critical data. Once isolated, the collected data is moved to secure environment where it can be preserved as accurate, authentic, and accessible to examination.

Analysis - Our examination staff will conduct a thorough assessment to determine the scope of the digital investigation and identify the data sources most likely to yield critical case information. We use a structured process for examining, identifying, separating, converting, and modeling data to transform it into useful information.

Documentation - All findings and processes need to be documented in a clear manner for later use and presentation.  To make our reports useable to both non-technical and technical readers, we provide an overall summary of our forensic results, describe their investigative significance, and follow up with technical details to later reproduce our results. In every case, the report must have adequate and acceptable evidence to be accepted into a court of law.

Presentation – In some instances, the forensic findings will need to be presented during a legal hearing.  Our examiners act as expert witnesses to clearly explain the most complex concepts to non-technical audiences.