While we typically don’t think about it; our mobile phones, computers, and other digital devices know nearly everything about us. They connect us to email, let us watch movies, retrieve information on a regular basis, track where we go, and even how we get there. They know more about us than we would ever confess to a diary or tell a best friend.
Since these devices typically hold so much data; they can be invaluable sources of evidence. Whether it’s for a criminal, civil or family court matter, mobile devices can provide a large amount of information.
We understand issues with evidence custody and controlling the chain of custody so that information gained remains relevant in litigation. Our examiners are trained in forensic methods of data extraction using the same tools, technology, and processes in use by law enforcement agencies across the country.
Our examiners are skilled at dealing with traditional computer forensics, mobile phones and tablets, fitness trackers, GPS units, and a host of other digital devices. We also help clients in a number of different arenas:
- EEOC/Harassment/Hostile Work Environment Investigations
- Unauthorized disclosure of corporate information
- Internal fraud investigations
- Many others
How long does it take?
To better understand this, it’s important to understand that there are two stages to most digital forensic examinations. The first is data collection – e.g. actually getting data off of the device. The second is analyzing that data. Most data collection can be done in a couple of hours, though there may be circumstances where it might takes days to bypass restrictions on the device. Once data collection has successfully completed, we can return the device without further delay. The length of time the analysis takes is dependent on a few factors, namely the amount of data, and what types of data we are looking for.
Are you always successful?
No, and anyone who tells you they are successful all of the time is being disingenuous. Forensic acquisition is often times a battle of security controls; and device security controls is an ever-evolving arms race.
If I need to have a device examined, what should I do?
If it’s an internet connected device, such as a cell phone or computer, you should sever communications ties if at all possible. This may mean putting the device in a signal blocking box or putting the device into airplane mode. Of course, if the device is already powered off, leave it powered off. You should have as little interaction with the device as well as any applications or data on the device as possible. Next you should take note of when you received the device (date, time, and location) and from whom it was received. Finally, you want to turn it over to a forensic examiner as soon as possible.