Computer Forensics Guide

The better question is where is when is computer forensics not useful as a tool? Initially computer forensics involved just computers, network devices, or storage devices. Over time, phones became more complex and replaced PDA’s then tablets and iPads came along. All of these store information that can be analyzed to understand a person’s actions, motives, and can provide key evidence in any case.

Some common cases our computer forensics service helps with:

After a computer forensic experts identifies, collects, preserves, and analyzes all digital devices you will be provided with a report. This report will explain the essentials which are the following:

• Who – Who was the signed in user when the action occurred ( placing a user behind the keyboard at a specific time is another part of the science of Computer Forensics)
• What – What evidence was specifically found and how it relates to the case. It will also provide an accurate description of the item and condition at the time.
• When – When did the evidence or potential evidence appear on the device (timestamps if available – possibly from file system or logs.
• Where – Where is the evidence located (another examiner for opposing council may check our work, in which case the location of the where the evidence was found is crucial). In addition if the evidence needs to be displayed or is questioned, the examiner will need to retrieve it quickly.
• Why – Is there any indications on the device as to why the person may have committed the offense/ crime?
• How – How did they commit the offense? Did they use file sharing programs? Email? Cloud Storage? External Storage?

• Attempt Computer Forensics Yourself – Everyone has that friend that knows “computers” but the reality is you will do more damage than good and can destroy evidence.
• Leave Device Attached to Network or Accessible – If a person of interest has access to they device they can destroy or overwrite evidence. Likeway if the device is attached to a network it can be accessed remotely and evidence can also be destroyed.
• Obtain Device Illegally – Illegally obtained devices can be inadmissible and leave you open to criminal investigation.