Computer Forensics
Computer Forensics involves the recovery and analysis of latent (hidden) information in the interests of determining potential legal evidence. Latent computer evidence includes the analysis of all active (current) files and folders on a computer, and all files and folders that have been deleted or lost, either intentionally or unintentionally from a computers disk drive.
Civil litigations may use personal and business information from computer systems in cases of: fraud, discrimination, divorce, harassment, etc. Criminal Prosecutors may use computer evidence in cases of: financial fraud, child pornography, etc. Insurance Companies may use computer evidence to mitigate costs in cases of: fraud, arson, compensation claims, etc. Companies may use computer evidence is cases of: fraud, physical and sexual harassment, theft or misappropriation of intellectual property rights, and/or other internal/confidential information.
Civil litigations may use personal and business information from computer systems in cases of: fraud, discrimination, divorce, harassment, etc. Criminal Prosecutors may use computer evidence in cases of: financial fraud, child pornography, etc. Insurance Companies may use computer evidence to mitigate costs in cases of: fraud, arson, compensation claims, etc. Companies may use computer evidence is cases of: fraud, physical and sexual harassment, theft or misappropriation of intellectual property rights, and/or other internal/confidential information.
Law enforcement officials may use computer evidence in the preparation of search warrants and the analysis of seized computer systems, disk drives, etc.
Key requirements of a computer forensics solution are:
- Detects and recovers all files on the computer systems physical disk drives. This includes existing (active) files, deleted files, lost files, hidden files, encrypted files, corrupt files, and password-protected files.
- Detects and recovers all files on all types of removable storage media e.g. memory sticks, pen drives, memory cards, personal storage devices (iPods, phones), floppy disk drives, etc.
- Detects and recovers files where the file name/header has been destroyed e.g. by discovering the file signature remnants on the drive.
- Detects and reports on file dates e.g. the date a file was created, modified, last accessed, etc. The last accessed date also enables the administrator to determine when the file was actually deleted.
- Detects and recovers temporary files created by an application and/or the operating system.
- Detects and recovers data from a disk that has been reformatted.
- Detects and recovers data from areas of a disk where no partition currently exists e.g. unallocated areas of a disk drive. These areas may previously have retained data but the drives have subsequently been erased.
- Recovers the data in a secure way i.e. uses a read only methodology to detect the data, thereby ensuring that the data has not been altered in any way. In addition, writing new data to a drive can potentially overwrite the very data that you are attempting to recover. It is therefore very important that a read only methodology is employed when attempting to analyse a drive.
- Copies the entire drive. This includes the imaging of the file system structure, dates, times, existing (active) files, deleted files, lost files, hidden files, encrypted files, and password-protected files.
- Prints out, and/or exports the results of the drive analysis thereby listing all the detected file and folder data.
- Provides a log of the dates, time, etc, detailing when the drive was analyzed and the data detected.
FileRestore for Networks will recover data from a computer drive, where the data is otherwise considered as lost, hidden or deleted. FileRestore for Networks will recover the data, while preserving the integrity of the data, whether the computer is local, or located on the other side of the world.
