The first step in any digital forensics examination is to protect the original evidence in accordance with industry standards and digital forensics best practices. This is done by creating a forensic image of the original evidence item. A forensic image is a special type of copy of the original evidence, it contains all of the data found in the original, but that data is encapsulated in a forensic file format which makes it tamper-proof.
While the methods might differ between cell phones, servers, and laptops when creating forensic images, it is imperative that this process is done correctly. If digital evidence is handled improperly it can cause data to be changed, lost, or otherwise compromised. In addition, if the analysis is performed on the original evidence item there is no way for another expert to verify the work, since the original evidence is not encapsulated, or protected, by a forensic file.
Forensic Data Analysis
Our digital forensics experts create forensic images of thousands of electronic evidence items a year. They also commonly assess e-discovery companies by performing on-site forensic collections, utilizing regional labs in the United States, Canada, and the UK.
For internal counsel, risk managers, and executives charged with protecting sensitive company data, our examiners also can provide preemptive services such as the forensic imaging of electronic devices. For example, if an employee leaves, and there is concern they may have potentially stolen sensitive data such as customer lists or design schematics, our experts can create forensic images of the employee's devices. Our examiners can then place those copies in secure storage in the event of future litigation.