Q: What is Computer Forensics?
A: There a number of slightly varying definitions around. However, generally, computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve evidence/information which is magnetically stored or encoded.
Q: What are the common scenarios?
A: Wide and varied! Examples include:
- Employee internet abuse
- Unauthorized disclosure of corporate information and data
- Industrial espionage
- Damage assessment
- Criminal fraud and deception cases
- More general criminal cases and
- Countless others!
Q: What exactly is computer forensics and what does an expert in computer forensics do?
A: Computer forensics is a branch of digital forensic science pertaining to legal evidence found in computers and digital storage media. An individual that is an expert in computer forensics examines digital media in a forensically sound manner with the aim of identifying, preserving, recovering, analysing and presenting facts and opinions about the information, with the ultimate goal that the processes, results and professional opinions will be held up in the court of law.
If you believe that your digital device contains evidence of the past that you need for present and future purposes, you need a computer forensic expert, not an IT professional.
Q: What kind of devices can a computer forensic specialist access?
A: Complex technology is built into nearly every digital device we buy. All of these devices are recording data about their use. With proper forensic tools and knowledge, that information is accessible to a trained and certified computer forensic specialist
Q: WHAT IS THE DIFFERENCE BETWEEN A FORENSIC EXAM AND A NON-FORENSIC EXAM?
A: A forensic exam for wireless devices must follow certain protocols that ensure the data integrity is maintained. One way for data to be affected is through the receiving of wireless signals (such as text messages and voicemail messages). To maintain the forensic integrity of a device, it must be kept free of signals. Other steps such as proper custody tracking and data verification through hash values along with other procedures keep your evidence safe and admissible in court.
Q: CAN YOU REALLY GET DELETED DATA FROM CELL PHONES AND SIM CARDS?
A: Yes. Typically, information that is deleted in handheld devices remains on the device until it is overwritten by new data. Text messages can be stored on SIM Cards and, until deleted messages are overwritten, portions or the entire message can be recovered. The same is true for data such as photos, text messages, and multimedia messages on a number of cell phones and some PDAs. Some devices use dynamic storage and therefore, when something is deleted, it is gone but for the majority of handhelds, at least some deleted data can be recovered. We do not guarantee the recovery of deleted data from your devices, but we will do everything we can to recover whatever data is available.
Q: WHAT DATA CAN YOU GET FROM A DEVICE?
A: There is more information on cell phones and PDAs than meets the eye. In fact, there’s more information than you can view from the device. The actual data that can be acquired and analysed differs by model (for a list of models we can examine, please contact us.) For the most part, we can get call logs, contacts, images, text messages, deleted data (including messages and images), owner information, and more. However, the recovery of this data is very model dependent and can vary from one handset to another. There is not guarantee to the data that we are able to recover.
Q: CAN YOU DO AN EXAM ON ANY CELL PHONE MODEL?
A: Yes & No For advanced forensic consulting jobs, we can get some evidence from any device that can be used in court (sometimes, this evidence is not in the form of data but physical images of the phone screens). For our basic and non-forensic consulting services, we are limited to certain manufacturers and models. There are a number of cell phones that have no data connections (such as inexpensive pay-as-you-go phones). Other models have no software that can access and analyze the data in a forensic manner. For a list of models that we can perform exams on, please contact us.
Q: HOW LONG WILL A CONSULTING JOB TAKE?
A: That depends on the type of service you choose and the shipping methods you pick. For a complete forensic examination performed on an hourly basis, it can take a week or more depending on how much analysis you need. For our basic and non-forensic exams, we will process the device and ship it back typically within 3-5 business days