Computer Forensics Continued …

Service areas:

• Computer Forensics, Investigation of computer crime, computer fraud or computer abuse & misuse


• Advise clients on how to initiate an investigation & secure the evidence (computers and related media);


• Acquisition and Preservation of computer data & evidence, imaging and storage of electronic evidence;


• Examination & Analysis of computer hard drives and data;


• Recovery of Deleted Files and Documents to obtain evidence believed to no longer exist;


• Retrieval and tracking of E-mail and Internet Activity;
  
• Consultation Services for cases involving electronic evidence and computer forensics;


• Evaluation of Electronic Evidence the opposition intends to present at trial;

Limited Examination

In many instances a complete examination of all the data on in electronic format may not be authorized, possible, necessary or conducted for various reasons.

Some examples of limited examinations would be:

The scope of examination is limited by the search warrant or the courts. The equipment must be examined on premises. (This may require the examination of the original media.) The media size is so vast that a complete examination is not possible. The weight of the evidence already found is so overwhelming that a further search is not necessary. It is not possible to conduct a complete examination because of hardware, operating systems or other conditions beyond the examiners control.

The time required for a limited examination of a single computer will depend upon operating system, the type of data contained on the media, the type of password protection, hardware problems and the specific examination required by the client. Multiple hard drives in one computer may increase the amount of time involved. Examination of floppy diskettes or other removable media, in addition to the computer media will increase the time involved for the examination.

Complete Examination

A complete examination is an examination of the entire computer media. The time required for a complete examination of a single computer will depend upon the type of operating system, the type of data contained on the media, any password protection, hardware problems and the amount of data on the media. Multiple hard drives in one computer may increase the amount of time involved in the examination. Examination of floppy diskettes or other removable media, in addition to the computer media, will increase the amount of time involved for the examination.

Policies surrounding our procedures

Each phase of a Datavic investigation is undertaken with the consideration that a court trial is the last stage. This means that Datavic gathers and preserves evidence using known and accepted practices for electronic evidence handling. We will ensure the chain of custody remains unbroken throughout our involvement in the investigations. All dealings with Datavic remain strictly confidential; at no time will information obtained for you be divulged without consent.

Court Appearances

A well prepared, competent and professional witness is one of the keys to a successful trial. We will assist you in the presentation of the electronic evidence that we provide. You can expect the utmost in professional preparation and conduct during any legal proceeding.

Additionally, we can assist in the examination of evidence collected and processed by alternate means. You will be confident that the electronic evidence is complete and accurate, and that the integrity of the original evidence has been maintained.