Computer Forensics

As our need for technology, computers, networks and servers grow, so has the demand for computer forensics and forensic discovery. Our findings indicate an increased demand of discovering suspicions employee activities, or implementing a standard acquisition and reporting of terminated employee's data. This seems to be a driving force for our Computer Forensic Services. RestoreMyData provides Forensic Data Recovery Investigations and can help in the discovery of covert illegal employee activities or fraudulent activities. We recommend companies seek our advice to assist them in understanding the nature and complexity of their computer discovery inquiry. We will advise you of the appropriate required protocols to follow to ensure the incident and discovery are handled properly and legally. RestoreMyData can then implement a strategy to perform an investigative forensic discovery, data recovery and documentation of the entire event. Evidence must be collected and stored in a forensically sound manner. The "chain of evidence" must be sound, secure, and verifiable if electronic evidence is to be accepted in a court of law.

Data Recovery Verses Forensic Data Recovery

Most data recovery companies do not perform Forensic Data Recoveries or are equipped to perform this legal action. Forensic discovery requires that evidence be processed via strict acceptable guidelines as defined by the courts. Providing a disk copy or image of electronic evidence is not acceptable as legal evidence. Special mathematical calculations are performed and required to verify the validity of the electronic evidence. While many data recovery companies offer disk imaging, they can not prove due diligence. Proof of due diligence is required for a court to accept forensic electronic evidence and documented data recovery.

RestoreMyData offers off hours and remote discovery services to companies that are seeking our Forensic Discovery Service. To ensure a valid forensic discovery can be properly executed, we highly recommend contacting us prior to taking any action.

Confidentiality is strictly enforced. We guarantee it!

Computer Forensic Discovery Services:

Forensic computer discovery is the science of documenting an audit trail, and the process of investigating computer systems believed to be involved in a "cybercrime". Computer crime has increased significantly thereby creating huge demands for computer forensics. RestoreMyData has found that corporations are becoming very engaged in learning and understanding the fundamentals of how cybercrimes are committed. These companies are especially interested in securing their own intellectual property and protecting themselves from employees "stealing" trade secrets. In addition, our computer forensic services are also utilized to discover and document employees abusing their desktop, notebook, laptop or workstation for personal or illegal activities. Strict computer forensic processes are required to ensure the submitted electronic evidence will stand up in court.

Forensic Disk Imaging Services

To ensure discovery is properly performed, RestoreMyData assists in gathering electronic evidence and collaborating with law enforcement or the interested party. In an effort to meet the computer forensic demands, RestoreMyData now offers a low profile, on site and off hours imaging service. This forensic discovery service reduces potential suspicion of any involved party during a cybercrime investigation. Offsite or remote discovery is also offered, however, onsite is preferable based on speed and reliability of accomplishing a forensic disk image. Great care must be taken during the forensic discovery imaging process. If the original hard drive is altered, it will be invalidated and not be admitted as evidence in a court of law.

Forensic Recovery - Software Vs. Hardware Disk Imaging

While third party software solutions are available to copy digital information, many prove to be slow or inadequate in a court of law. This may allow a defense attorney the opportunity to invalidate the data by claiming the data was "altered" or not reliable. Verifying the authenticity of electronic evidence is crucial for conviction. Our forensic hardware equipment is effective, accurate, fast and accepted in a court of law. Forensic hardware solutions, quickly copy hard drives including deleted and encrypted files accurately. In fact, software solutions, even those provided by the leaders in software forensics, can not compete with forensic imaging hardware. The latest technology forensic hardware imaging equipment is at least several times faster than any software solution. This is especially important when a copy of the suspect's hard drive must be secretly made and our computer forensic specialist only has a brief window of time to make a forensically sound image.

Industries Utilizing Forensic Discovery Services

• Attorneys.
• CPA Firms.
• Corporate America.
• Insurance Industry.
• Medical Industry.
• Individuals.

Understanding Computer Forensic Applications

• Get a forensic record for exiting employee on job termination.
• Discovery of covert illegal business practices.
• Identify if trade secrets are being stolen.
• Legal analysis that "due diligence" was followed.
• Discovery of fraudulent activities.
• Airtight, documented proof of data discovery and disk image.
• Assist in discovery and documentation of identity theft.
• Learn of fraudulent accounting practices.

Forensic Discovery Services

Some of our computer forensic findings reveal that camouflaged files were used. Camouflaged files are files that have been renamed, hidden or associated to an application that cannot recognize the file. This is a common practice used in cyber crime to hide incriminating data, content, or criminal activity.

There are many methods by which a forensic discovery is performed to identify illegal activities. A handful of the more common methods of Electronic Discovery are:

• Employee Deleted, Changed Or Downloaded Files.
• Manipulated Legal Documents.
• Deleted Or Changed Emails.
• Misuse of Internet by Employee.
• Deleted Profiles Or Partitions by Employee.
• Disguised Or Hidden Files.
• Evaluated Swap Files and Slack Files.
• Recovery of Printed and Faxed Documents.

Electronic Discovery FAQ:

Why Not Conduct My Own Forensic Discovery?

Performing your own investigation is not advisable. RestoreMyData has provided a brief outline describing how companies can invalidate or compromise their own evidence gathering while performing discovery.

Action:

Company ABC used their internal staff to perform discovery on a computer in question. Their technician turns on the computer and prints the suspicious files and then downloads these files onto external media as evidence. This action seems to be passive, non invasive and valid, however, note the consequence of this action.

Consequence:

• Chain of custody was invalidated.
• Some evidence was destroyed.
• Data was compromised & may be invalidated in court.
• Forensic Discovery increased the cost of the investigation.

Forensic Solution:

RestoreMyData may be able to salvage the damaged evidence. This "undo" process is very time consuming and expensive, however, this option is available via our forensics data recovery service.

How Do I Conduct A Forensic Discovery?

Action:

Company ABC noticed some unusual cybercrime events such as files being changed, hidden or camouflaged. This company or individual is seeking guidance but hesitates to take action due to perceived high costs incurred.

Consequence:

Forensic discovery relies on the ability to reconstruct timelines of data accessed, deleted, concealed or camouflaged. The longer the delay, the more likely recoverable data will be overwritten, hence complicating and impeding the recovery process. This inaction unfortunately significantly increases the cost of a forensic discovery service.

The Solution:

RestoreMyData offers a discovery service that will make a forensic image of the media at a specific point in time. This image is then securely stored and examined at a later date. In this way, the client has the ability to go back in time and begin an investigation on the secured disk. This option is very cost effective and offers the client flexibility in their decision making process.

How To Reduce Forensic Recovery Costs

Action:

Company ABC needed to perform a forensic investigative service and requested a forensic discovery. They chose the wrong company and then realized that they looked for evidence in the wrong location.

Consequence:

There is no valuable information recovered to support the clients' suspicions. Proof and the investigation are stopped due to lack of evidence. The client unnecessarily paid for an unproductive investigation.

The Solution:

RestoreMyData offers a consultation service to educate the client on the forensic discovery investigation strategy. Depending on the nature of the cybercrime, we would provide options to the client so they may better understand how the employee could have contributed to the cybercrime.

Probing Questions RestoreMyData Might Ask:

• Was the potential suspect authorized to log into the company server via remote access?
• Could the potential suspect have used an e-mail server?
• Did this individual have access to a company owned laptop or notebook, workstation or server?
• Was a home computer used?
• Your answers would ultimately assist us in directing the client of the appropriate cost saving investigative strategy to implement.

Our Policy:

RestoreMyData follows the accepted protocols and guidelines to conduct a thorough forensic discovery investigation. We specialize in the restoration of data caused by employee sabotage and the discovery of trade secret theft.

Our initial consultation is free.
We guarantee complete confidentiality.
RestoreMyData offers flexible scheduling options.

As always, RestoreMyData takes great pride in providing clients with professionalism and respect. We take our policies and procedures very seriously.

Free Forensic Recovery Quote  |  Live Phone Support