eForensicsPro (425) 200-4271
9 am - 4 pm Pacific Time
Request a Consultation
|
|
|
|
"Suspect evidence of wrongdoing on a computer?
The first thing to do is do nothing with the device."

Terry Lahman
Founder, Chief Digital Forensics Analyst
eForensicsPro

Forensics Services

   Data Recovery
   Data Preservation
   Preliminary Analysis and Planning
   Password Recovery and Defeats
   Secure Data Elimination
   Digital Forensics for Businesses
   Digital Forensics for Attorneys

Consulting

   DFA Consulting for Businesses
   DFA Consulting for Attorneys
Tips around data preservation:
  • Better safe than sorry. If you suspect that someone has committed a wrongdoing using a computer, laptop or other digital device you are authorized to access, have me preserve the hard drive's contents for analysis. I'll determine exactly what happened, when it happened, and in what sequence it happened, so you can determine the proper next steps.
  • Act fast. Call me as soon as you suspect something. Besides the changes that are made to data through normal day-to-day use, the user may attempt to alter, delete, copy or transfer the electronic data in question or dispose of the device altogether. The sooner we act, the better our chances of getting at the truth.
  • Err on the side of caution. Work computers and laptops are often reassigned to other people or designated for recycling or disposal. Whether you suspect foul play or simply want to save a device's content, let me preserve the data for you in the most secure manner possible before it changes hands.
Data Preservation

If you suspect that a computer, laptop or other digital device may hold critical evidence of wrongdoing, call me as soon as possible. Don't do anything to the device – don't copy files, don't even turn the machine on or off – until we talk.

Here's why. Civil suits and criminal cases are won and lost on the basis of evidence. When the evidence is electronic, you need to prove that it mirrors byte for byte exactly what existed on the hard drive when the device in question was first examined.

If you turn the device on or off incorrectly, or copy files, you change the data on the hard drive. However innocent, the change leaves a footprint, which can later give opposing counsel cause to question and request to throw out any evidence the drive might have held.

The way I safely preserve digital evidence for later use is by creating a forensically sound image of the hard drive at the disk drive level. This ensures that I preserve everything, including all hidden files, system files and even unused folder space where crucial evidence may be stored, without changing anything.

About delicate situations.

Don't be concerned if authorities have seized the digital device in question. I have the mobile equipment necessary to preserve data just about anywhere, including in police stations and FBI offices and in work environments after hours.

Let's get started.

Call me at (425) 200-4271 and tell me about your problem. I'll let you know how I can help and what needs to happen next.







© 2012 - 2020 by eForensicsPro. All rights reserved.

Site Map  |  Home  |  Data Recovery  |  Data Preservation  |  Preliminary Analysis and Planning  |  Password Recovery and Defeats  |  Secure Data Elimination  |  Digital Forensics for Businesses  |  Digital Forensics for Attorneys  |  DFA Consulting for Businesses  |  DFA Consulting for Attorneys  |  What to Look for in a DFA  |  About Terry Lahman  |  Mission/Vision/Values  |  Why Choose eForensicsPro  |  Privacy Policy  |  Contact and Email  |