FAQ

What is Computer Forensics?

Who needs Computer Forensic Services?

What types of cases can utilize Computer Forensics?

What happens to data after it is deleted?

Can evidence be extracted from blackberry’s, PDA’s and cell phones?

Who pays for the cost of e-discovery and/or computer forensics?

Can my internal IT department conduct a forensic investigation or audit?

Can deleted internet history be recovered?

What is Electronic Discovery / Computer Forensics?

Electronic Discovery / Computer Forensics is the collection, preservation, analysis, and court presentation of computer-related evidence.

Back

Who needs Computer Forensics Services?

Computer Forensics services are critical in any investigation where the computer is the target or instrument of a computer-related crime or security incident.

Attorneys, Individuals, and Corporations utilize electronic discovery and computer forensics services.

Attorneys and Individuals generally utilize electronic discovery and computer forensics in an investigation.

Corporations utilize e-discovery and computer forensics in administrative and legal proceedings, and in a preventative nature. A corporation can utilize these services as prevention from costly lawsuits by proactively preserving all data related to suspect employees, prior to a potential litigation. In addition, corporations can prevent potential future issues when employees leave or are terminated by analyzing their media to determine if proprietary information has been printed, e-mailed, deleted, or copied without authorization.

Back

What types of cases can utilize Computer Forensics?

Family Law ( Divorce, Child Custody, etc ), Criminal Law ( Child Pornography, Blackmail, etc ), Intellectual Property Theft, Employment Disputes ( Breach of Contract, Breach of Confidentiality, etc ), Destruction or Misappropriation of Data, Alteration of Data or Misuse of Software, Use of Unlicensed Software, Illegal Duplication of Software, Unauthorized Access to a Computer System, Unauthorized Use of a Computer System for Private Gain, Unofficial Access to Confidential Data, E-mail Misuse, CyberTerrrorism, Harassment, Insurance or Securities Fraud, Computer Hacking or Phreaking, Identity Theft, and many others.

Back

What happens to data after it is deleted?

In many cases, even if files are deleted and ‘invisible’ to the operating system, a certified computer forensics expert can locate, reconstruct, and recover these files.

Back

Can evidence be extracted from blackberry’s, PDA’s and cell phones?

Yes, evidence can be extracted from desktop hard drives, personal computers ( laptops ), PDA’s, cell phones, Tapes, DVD’s, CD’s, digital cameras, and other electronic devices.

Back

Who pays for the cost of e-discovery and/or computer forensics?

The burden of discovery costs generally falls on the responding party. However, in some cases, these costs may be shifted and allocated to the requesting party as the courts see fit. This depends on case precedents and whether the court views these discovery costs as being an ‘undue burden or expense’ on the responding party.

The case precedents have become known as the ‘Zubulake Factors’. For more information, please see Zubulake v. UBS Warburg LLC, 2003 U.S. Dist. LEXIS 7939, 91 Fair Empl. Prac. Cas. (BNA) 1574 (S.D.N.Y. May 13, 2003).

Back

Can my internal IT department conduct a forensic investigation or audit?

Although an internal IT department may be able to locate some data that may be pertinent to an investigation, the services of a certified computer forensics expert is necessary to ensure that any evidence collected is admissible in court. The proper seizure and analysis of computer evidence is assured by the certified computer forensics expert. This includes properly acquiring a forensic copy of the evidence; recovering all available data, including deleted and temporary files; authenticating the data for possible presentation in court; preserving the legal chain of custody and integrity of this data; customizing analysis and reports for the investigation, and providing expert witness testimony for depositions, or in court, if necessary.

In addition, certified computer forensic experts utilize specialized forensic hardware and software tools, password recovery tools, file carving utilities, hashing applications, email extraction utilities, and internet history and file viewers. Lastly, computer forensic experts receive specialized training, and in the case of Miles Computer Forensics, our experts are certified on specialized, court-verified forensic software, and industry best practices.

An internal IT department cannot provide an unbiased opinion, in the eyes of the court, and the defense may claim tampering of the evidence has occurred, or that the data was acquired without following proper forensic protocols, and is not authentic, and/or the data integrity is in question.

Back

Can deleted internet history be recovered?

Yes, the deleted internet history can be recovered, even though it is invisible to the operating system. In most cases, the internet history file can be recovered utilizing specialized forensic tools.

Back

Contact us for more information.