Digital Forensics

Digital Forensics at a Glance

When it comes to investigations and litigation, the digital world in which we live is a moving target of data sources, smartphone usage, online services, social media, and cloud storage. It’s a challenge to know where you should be looking and what you should be looking for. Precise’s years of experience across hundreds of forensics matters will help you determine what is forensically possible and why you might want to include it in your legal strategy. Because of our experience with all stages of the eDiscovery process, our analysts take a meticulous approach to help you avoid unnecessary spoliation risks associated with improper data collection while protecting you from the common and expensive pitfall of over-collection.

Use our digital forensic services to narrow and focus your overall case strategy and guide and clarify your discovery.

Digital Forensics Services

Precise offers a full suite of digital forensics services. Because the types of needs can vary, it’s next to impossible to list everything. That’s why we typically suggest an initial case overview call to make sure we understand your needs and provide options that best meet them. The list below encompasses some of the most commonly requested digital forensics services.

Precise can perform a byte-level, hash-verified acquisition of all data and information on a digital device. All information, such as operating system files, deleted data, metadata, and all user-created files and data, is preserved in its original format. Forensic imaging provides the best possible manner of preserving evidence and minimizes the time disruption to the client in the collection process. Forensic imaging is the most legally defensible way of collecting digital devices. Smartphones, laptops, tablets, desktops, and servers are commonly collected through forensic imaging.

Precise’s analysts can target and forensically image specific areas of a mobile device, computer, laptop, server, or network. A targeted collection is instrumental when the data sources are extremely large or highly sensitive (but non-relevant) data also exists on the device. Analysts often use targeted collections when looking for specific network directories or when the client knows relevant data is likely limited to particular and identifiable areas. Our team preserves all metadata and system data within a targeted collection.

Particularly useful with clients’ geographically dispersed devices, computer forensic tools are securely executed on the remote machine to specifically target digital information or forensically image an entire hard drive. When performing a remote collection, data can be culled and filtered prior to making any forensic data acquisitions. Not all devices are good candidates for remote collections. Please check with Precise to determine whether your data sources qualify.

Recognized as experts in federal and state jurisdictions, Precise’s forensic analysts can prepare expert reports and author affidavits, declarations, and oral reports. Should the case go to trial, our forensic analysts can provide expert testimony in court or through deposition and prepare and deliver quality technical presentations. Some examples of typical device analysis include cell phone usage during critical time periods; when a user modified or copied files; what and when files were deleted, where a smartphone was at different times, and what applications were residing and used on a phone.

Precise will manage a forensic collection of case-relevant data throughout major social media networks. Our team will identify, preserve, search, and produce social media data while keeping important metadata intact to increase admissibility. Some social media sources are so voluminous it requires targeting time frames or interactions with other users to retrieve digestible data. Because the popularity of social media applications changes so frequently, this tends to be an area in constant flux.

Precise’s computer forensic software can filter, cull, and sort data based on criteria such as filename, filename extension, file header and footer, MD5 or other hash value, type of file, file size, creation date and time, last accessed date and time, deleted date and time, or last edited date and time of the file or filename. This level of filtering can become critical for lowering the overall volume of data being moved along to investigation or eDiscovery, saving both time and expense.

Precise can retrieve data from unallocated (unused) areas of a computer hard drive long after deletion. In some cases, data that a person deleted years before can be retrieved. Some items that may be recoverable include the filename, content of the data, images, and metadata. We can reconstitute formatted hard drives to their original format. Even when users have deleted files and emptied the “recycle bin,” data can exist on the hard drive of many devices for a long time.

Precise’s forensic analysts have been recognized as experts in both federal and state jurisdictions. They can prepare expert reports and author affidavits, declarations, and oral reports. Should the case go to trial, our forensic analysts can provide expert testimony in court or through deposition and prepare and deliver quality technical presentations. Given our years of experience with trial consulting, we understand the importance of taking complex information and explaining it in an understandable and compelling way. That background comes to bear in all testimony provided.

Why hire a forensic examiner to preserve data?

Our forensics examiner, Jeffrey Stiegler, explains the value that forensics expertise can bring toward a sound case strategy.