Certified forensic collections & detailed custodian reports
Through the use of certified Encase technologies and personnel you can freeze the data collected from various sources in time.
Utlizing intelligent data collection techniques, we will provide a preliminary report ( Sample Report ) on the content of each custodian’s collection to allow you to separate what needs to be processed.
The following are color charted diagrams and spreadsheets and provided as part of the collection effort in the report.
This not only provides for a defensible means of eliminating non relevant documents, it also reduces the overall cost to process the remaining documents prior to loading them into an Online/offline storage repository for further review.
The following are some of basic steps we go through to provide you with a seamless and hands free collection and investigation of your clients’ data.
Recommended Next Steps:
- Meeting between examiner and counsel to review the complete data contained within the forensic images and discuss next steps and potential options.
- Production of the supporting tables summarized within this report for client review.
- Draft timeline of events relating to notable activities both on the computer and outside events leading up to the time of forensic collection of the data.
- Search for user webmail accounts including regularly visited T-mobile, MSN, Google and Yahoo websites all of which offer web based email accounts.
- Organization of data extracted to allow for better understanding of the nature of data based on various criteria.
- Further production of files, and forensic analysis of relevant data and activities on dates of notable activity.
Collection without reporting make no sense! Litigators need to know the complete detail of what’s been collected before authorizing new expenditures for the valued clients. These reports can be produced to your clientele, allowing them to make an intelligent decision on how to proceed.
This report has focused mainly on the overall data sizes and types per volume for this collection. Additional analysis and reporting can be performed on this data based on the needs of counsel and requirements set forth in the future requests. These reports are include but are not limited to the following:
- Registry hive analysis per machine
- Files or programs utilized prior to the date of collection according to the Windows prefetch information contained in this data.
- Internet viewing history information on a per user basis.
- Internet favorites information as shown in the favorites folders.
Depending on the nature of the case and requirements, the data contained in this collection can be separated into small batches according to different criteria and produced according to these requirements.
Further scoping of these requirements is recommended. This can be accomplished with meetings between the investigator and counsel.