FAQs

Digital Forensics or Computer Forensics involves the science of identifying, preserving and recovering digitally stored evidence. As such it is a science and is not disprovable. This is often used in a legal dispute and can involve any device that contains digital information; including mobile devices, hard drives, flash drives, SD cards and other flash memory, and cloud storage.

A forensic image is an exact sector by sector copy of any digital media. This is usually done by using specialized software and a write blocker to make an identical copy that is preserved and thereby admissible in a court of law. This also copies the unallocated and un-used space which means deleted files can be analyzed and recovered.

Fortunately Secure Forensics has an in house award winning data recovery lab. We have the highest success rate in the industry at over 96%, so if your media is damaged we can still perform digital forensics after the data recovery process.

This data explains information about a specific file or document. Metadata is used to understand what activities occurred using any digital device. Even if the metadata was tampered with our forensics investigators can spot inconsistencies to reveal evidence of tampering or destruction of evidence.

Unallocated space is the free or unused space of a hard drive or other digital storage media. With few exceptions, deleted data resides in unallocated space until that space is reused for new files. This allows our investigators to identify and recover deleted data.

After the retainer is received, we offer both delivery and onsite collection options. After we receive your evidence, we’ll preserve it in its received state by creating an exact copy of its contents for analysis and securing the original in our secure storage facility. We’ll then analyze that copy for evidence based upon your analysis goals or needs. You’ll receive a full report of the process and findings for use in your legal or investigative process.

The report is delivered electronically; any potential findings or electronic evidence can be delivered by hardware encrypted hard drive.

We have over 50 offices that can accept deliveries nationwide, some evidence items can’t be transported and must be acquired on site. Secure Forensics is equipped to handle onsite acquisitions with advanced notice.

Our services are typically performed at $250 per hour starting with a 6-hour $1500 retainer.

Most analyses require anywhere from 10-40 hours, depending on the quantity of evidence to be analyzed. We typically are able to provide a preliminary analysis and an estimate of any additional time required after the first 10-15 hours.

Most standard analyses typically require 2-6 weeks to complete. Large storage environments or analyses with more than 2 devices may take longer. We also have emergency service options available if your case is time sensitive.

We are a fully certified lab with over 60 points of processes and controls audited by a third party under the SSAE 16(soon to be 18) standard. Our forensic examiners have more than 15 years average experience and we can provide the credentials of your case’s forensic examiner upon request. We also return the data on a Pending FIPS Level 3 Hardware Encrypted Hard Drive.