When producing forensic evidence for the courts, the simple rule is: original is best. This makes perfect sense when dealing with material items that can be examined without having their evidentiary value compromised. However, what should be done about computer data?
Imaging is the industry-accepted standard for the preservation of computer-based evidence. Much different than a simple copy or a backup of your data, imaging is a non-invasive method of producing a complete sector-by-sector copy of an electronic storage device. It is the electronic version of "freezing the scene." The image can be stored on a durable medium such as a DVD and is used as the working copy for examination and production of evidence.
Imaging of the client's hard drive(s) is essential for various reasons. The most important purpose is the preservation of the original evidence (client hard drive). During the imaging process, the client hard drive is not altered in any way. In fact, a mathematical algorithm is calculated prior to imaging and again after imaging. These calculations should be identical: an exact copy has been made and the original hard drive has not been tampered with. The imaging process captures all data, including deleted information and data found in unallocated space. Our methods ensure all of the data on a hard drive is retained and recovered.
Hard drive images are also made so that the original hard drive can be placed into evidence. All subsequent data recovery and analysis is then completed on the imaged copy. This method ensures the original is not altered and no data can be deleted accidentally. Many of our clients' cases do not start out as legal cases but consequently turn into them after our analysis. Having a hard drive that has not been tampered with is absolutely necessary for successful litigation.
Computer Forensic Services, Inc.'s forensic-imaging process is conducted using the latest technology and procedures that adhere to the Department of Justice guidelines and technical standards. These methods have undergone extreme scrutiny by the legal system and are currently accepted at all levels of the court.
If you would like more information about the imaging process, please contact us at info@compforensics.com. |
