Computer Forensics Services
Computer forensics services we provide have the ability to help reveal the exact actions taken by a computer user. From documents that were accessed, deleted or transferred to remote locations, or understanding a computer user’s internet surfing activities, computer forensics can be very revealing. Because of the insight provided by computer forensics, civil litigation often requires the use of a qualified and experienced computer forensics expert witness to assist with understanding the facts related to a computer’s use and activities by the purported computer user.
Computer forensics is often necessary to understand what events recently transpired on a computer. Sometimes computer users will attempt to hide or conceal illicit use of their computer while working on company time. The usage of obsification technologies including encryption and privacy software that is often used by rogue employees as an effort to obscure their inappropriate activities. Most employees leaving their company for a competitor can’t resist the urge to take client data, vendor supplier information, past quotations, employee information and more. This information is often used by the recently departed employee to steal clients, vendors, data models and employees away from their former employer. Intellectual property today often exists in digital form and as such, tons of banker boxes worth of data can be copied in under an hour to a portable USB storage device that can be purchased for under thirty dollars.
There are many types of questions that computer forensic examiners are often asked to research and respond to. Companies that are wondering if an employee took trade secrets or business confidential data with them before leaving often wonder if there were any external storage devices recently connected to the computer and is there are any indications that suggest a computer user copied or transferred company files, trade secrets and other sensitive data to external sources?
Today the average knowledge worker has access to many different types of data storage vehicles including:
- Internet based cloud storage? (Google® Drive®/Docs®, Dropbox®, iCloud®, FTP, or other)
- USB Storage Devices? (External Hard Drives, Jump drives, Thumb Drives, Cell Phones & SIM Cards Disk Media)
- Webmail or email?
- iPads or tablet based computing device?
Other questions that are often pursued during a computer forensics examination may include:
- What specific actions took place on a key date and time by the user?
- Did the user run or install programs that are designed to obfuscate or cover their tracks?
- What files were deleted by the user?
- Did the employee engage in bad faith and provide information to outside parties?
- Did the employee break the company policy regarding standards of acceptable computer usage?
- Is the document produced really as it appears or is it a forged electronic document?
- Did anyone else access the computer who may be trying to frame the suspect or perpetrator?
Computer forensic activity and usage analysis can help answer these questions and more. Forensicon computer forensic examiners are skilled at finding data that other firms miss and then sequencing and analyzing the Meta data so that a narrative explanation of the events that took place can be established.
Analysis of the computer registry and other artifacts including link files, USB device history, Windows® restore points, unallocated space, deleted files, recently run programs as indicated by the Windows Prefetch all can help piece together the story of what transpired.
In some instances, the computer user may perform actions on the computer that complicates a forensic investigation by purging many of these sources of information beyond recovery or detection. In circumstances where deliberate efforts were taken by the computer user to purge and destroy data beyond recovery, Forensicon can often use our years of experience to help demonstrate that the computer lacks the normal pattern of data that exists on a computer in regular use.
Some employees utilize scrub software to cover their tracks, when this is discovered, it often suggestive of inappropriate behavior by the computer user. Computer forensics can help piece together what little remnant data might exist in order to reveal what actions took place.
Deletion of files often occur following rogue actions by a computer user. When computer data has been scrubbed, establishing with confidence whether the actions were a result of user initiated activity or a part of normal computer usage is often important to the courts. Obtaining the facts and having them presented by an experienced and qualified computer forensics expert who can render an opinion and interpretation of the meta data discovered is often crucial to support a motion for sanctions. Forensicon’s computer forensics experts can testify and help a Judge or hearing body understand the significance of the resulting meta data. Smart litigators and company’s know that obtaining quality and experienced counsel before pursuing actions that might impact or result in litigation is imperative.
Proving usage of scrub software is a more challenging undertaking in many instances and often requires an experienced expert to persuade a court of law to accept an opinion that deliberate user initiated actions took place specifically for the purpose of concealing potentially relevant data from the legal discovery process.
Forensicon has appeared in court or testified via affidavit regarding the alleged usage of data scrubbing software. Forensicon experts have achieved successful outcomes where scrub software was used and has supported counsel with obtaining remedies from the courts. Selecting an experienced outside independent forensic firm to forensically image the suspect’s computer and perform forensic activity analysis in an attempt to validate management’s initial suspicions can help mitigate risk and provide objective proof to suspicions and allegations that may require disciplinary action of the employee. Before considering terminating, suspending or reporting an employee to legal authorities, companies and organizations should conduct a forensic investigation of the employee’s computer to understand what facts exist that may validate or rebut management’s initial suspicions. Having a trustworthy and experienced forensics firm at your side can help your organization avoid unnecessary and costly employment litigation.
Call Forensicon today at 888-427-5667 for a complimentary telephone consultation or contact us for your computer forensics investigation needs. To read more about other services in this area, please explore the following pages that provide additional service offering details relating to our computer forensic services offerings.