Accepted guidelines for forensic analysis

A forensic examiner is impartial. Our job is to analyze the media and report our findings with no presumption of guilt or innocence.

The media used in forensic examinations must be sterilized (zeroed) before each use.

A true image (sector by sector) of the original media must be made and used for the analysis.

The integrity of the original media must be maintained throughout the entire investigation.

Our Process

Consultation: The process will begin with a consultation session to ensure the appropriate services are provided to suit your needs.

Obtain the evidence: Forensic Discoveries we will work with you to ensure proper and secure packaging to be shipped to our examination lab. If the evidence cannot leave your site Forensic Discoveries will perform the proper procedures to obtain the needed evidence.

Forensic Analysis – While ensuring proper chain of custody procedures, Forensic discoveries will conduct a thorough investigation of the evidence to recover and decipher the information needed determined in the consultation phase.

Reporting – The results of the forensic examination will be conveyed in a formal report including a summary of the findings and the relevant data and files supporting the conclusion.

Expert Witness support – Forensic Discoveries will be available as needed to testify pertaining to the procedures and methodologies used in the investigation.

 

Our Procedures

An exact ‘fingerprint’ of the media or storage will be determined and verified

A ‘bit by bit’ copy will be made of the hard drive or evidence media and verified against the ‘fingerprint’ of the original evidence.

All examination procedures will be performed on the copy of the original evidence. This will ensure the integrity of the original evidence.

Identify leads and computer evidence contained in files and slack space, which can determine the outcome of the investigation.

Document the findings and provide expert witness testimony, if needed, to help clarify technical computer issues in the litigation process.

Deleted data, hidden data, and password-protected data can be retrieved in many instances. Forensic Discoveries can find data on a formatted hard drive, deleted e-mail, intentionally altered data and in some cases media that has been physically damaged. The recovered data is then carefully documented, analyzed, and recorded in reports which are presented to the client and/or in litigation.