eForensicsPro (425) 200-4271
9 am - 4 pm Pacific Time
Request a Consultation
|
|
|
|
"Hard drives don’t lie.
If there is evidence of misconduct on a company computer, I’ll find it."

Terry Lahman
Founder, Chief Digital Forensics Analyst
eForensicsPro

Forensics Services

   Data Recovery
   Data Preservation
   Preliminary Analysis and Planning
   Password Recovery and Defeats
   Secure Data Elimination
   Digital Forensics for Businesses
   Digital Forensics for Attorneys

Consulting

   DFA Consulting for Businesses
   DFA Consulting for Attorneys
Employee misconduct that may be exposed through DFA:
  • Pornography downloading/viewing on company time or property
  • Theft of confidential information, intellectual property, trade secrets
  • Software piracy or unauthorized software installation
  • Sexual harassment by email or instant messaging
  • Embezzlement or misappropriation of funds
  • Illegal music or video file downloading
  • Unauthorized destruction of files
  • Moonlighting on company time
  • Willful infection of computers
  • Falsification of records
  • Credit card cloning
  • Online gambling
  • Identity theft
  • Hacking
Digital Forensics for Businesses

Are you concerned that an employee may be surfing porn, misusing email, or otherwise violating computer use policy on a company computer, laptop or smart phone? Call me. I'll determine exactly what happened, when it happened, and in what sequence it happened, through digital forensics analysis (DFA).

What is DFA?

Digital forensics analysis is the process of capturing, analyzing and reporting on the contents of a digital device's hard drive, usually for the purpose of identifying evidence and determining how it got on the computer in a civil suit or criminal trial.

There are several steps involved:
    Step 1: Preliminary discussion. We have a conversation about your concerns or suspicions. I may suggest doing a preliminary data search to determine if evidence of wrongdoing even exists (which can save you a lot of time and money). Or, if you're certain that it does, we'll go over next steps for a full investigation.

    Step 2: Data preservation. I'll create a forensically sound image of the device's hard drive at the disk or partition level. This ensures that I preserve everything, including all hidden files, system files and unused folder space where crucial evidence may be stored, without changing anything on the hard drive.

    Step 3: Analysis. I'll use forensic hardware and software to thoroughly examine every part of the hard drive for evidence. This may include examining text files, email, photos, artwork, videos, chat, databases, software and more. I can even determine if files or entire portions of the hard drive have been "wiped" clean using erasure software (often a violation of a company's computer use policy).

    Step 4: Report. I report my findings in cascading depth. I write the executive summary for laypersons; the findings section for both laypersons and experts; and the technical addenda for other forensic analysts, if and as necessary. By clearly understanding what has occurred, you can decide what to do next.

    Step 5: Further assistance. If the evidence prompts you to seek legal counsel and pursue a civil suit or criminal trial, I can work with your attorney. (See Digital Forensics for Attorneys)
Immediate next steps.

If you have a situation in mind right now, here are two important things to consider:
    1. An employee who knows that he or she is suspected of violating company computer use policy may attempt to hide, suppress or delete any incriminating evidence, or dispose of the digital device altogether. For this reason, it may be best to hold back from confronting the individual until the computer or other digital device is forensically examined.

    2. Digital evidence must be preserved properly to ensure its admissibility in court. Do not handle the device. Do not turn it on or off or have anyone, not even IT personnel, copy any files, as these actions may taint whatever evidence may exist on the hard drive.
Call me instead and explain the situation. I'll go over next steps with you to ensure that evidence can be properly collected now and confidently defended later.

Why choose eForensicsPro?

Digital forensics analysis leaves no room for error. Here is why you can place your trust in me.
  • Technical expertise. I've been examining digital information on hard drives for over 30 years, including 17 years testing and perfecting software for Microsoft. On countless occasions, I've spotted anomalies in code that even my best engineers missed. That's one of the reasons they gave me the prestigious Microsoft Achievement Award.
  • DFA training. I trained in digital forensics analysis at Edmonds Community College in Edmonds, Washington. I completed the training at the top of my class.
  • PI licensure. I'm licensed as a private investigator in Washington State. (Note: states vary in their requirements. Some prohibit the collection of digital evidence by anyone who is not a licensed PI.)
  • Mobility. I have the equipment necessary to conduct digital forensics analyses just about anywhere: in police stations or FBI offices, when digital devices have been seized, and in work environments, both during and after hours.
  • Communication skills. Thanks to many corporate years of presenting technical information to non-technical audiences, I'm able to create forensic reports and presentations today than any layperson can understand.







© 2012 - 2022 by eForensicsPro. All rights reserved.

Site Map  |  Home  |  Data Recovery  |  Data Preservation  |  Preliminary Analysis and Planning  |  Password Recovery and Defeats  |  Secure Data Elimination  |  Digital Forensics for Businesses  |  Digital Forensics for Attorneys  |  DFA Consulting for Businesses  |  DFA Consulting for Attorneys  |  What to Look for in a DFA  |  About Terry Lahman  |  Mission/Vision/Values  |  Why Choose eForensicsPro  |  Privacy Policy  |  Contact and Email  |