Leveraging our training and experience, our staff can assist with pre-collection strategy, electronic data gathering activities, defensible acquisitions of data, conduct technical analysis, provide representation of techniques and procedures, and presentation of findings in legal proceedings as previously qualified experts in both state and Federal courts. Carolina Computer Forensics is prepared to work side by side with your legal team to help determine, discover, understand, and utilize all of the electronic evidence gathered in order to best position your case. By acting as an independent expert, we can provide the credibility and confidence to the Court that few can claim.
What services can be provided for Civil matters?
-
Data preservation - Maintaining a proper chain of custody for digital information and properly preserving the data for immediate or future use is of critical importance. Individuals and legal teams have only ONE opportunity to make sure this happens properly. Carolina Computer Forensics has handled thousands of items for hundreds of cases professionally and successfully.
-
Data recovery - Phones, Laptops, Desktops, tablets all contain digital information that might be critical to your case. Many people fail to realize that “deleted” information is frequently recoverable and admissible in court. Properly recovering this information in a defensible manner is a specialty of Carolina Computer Forensics.
-
eDiscovery / ESI - There are several practices that must be followed and requirements to be met in order for information to be admissible in court. Among these are creating and maintaining a Chain of Custody, proper collection of the data, proper storage of the data and analysis using acceptable tools. Given the inherent possibility of a conflict of interest, it is not recommended that internal Information Technology (IT) personnel perform this duty. Carolina Computer Forensics investigators are certified and court qualified experts that can perform this activity.
What is Intellectual Property?
Most businesses have financial, manufacturing, business, patent or process information that if mishandled or intentionally released to competitors could have a significant negative impact on the business. Carolina Computer Forensics is an experienced and capable partner for businesses that need to find out everything involving intellectual property that is at risk and who is involved.
What is eDiscovery?
eDiscovery is short for electronic discovery, which is defined as the process of discovery in civil litigation that is carried out in electronic formats. It encompasses what most often is referred to as electronically stored information, or ESI.
eDiscovery refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal matter. eDiscovery collections can be carried out offline on a particular computer or media, alternatively collections can be performed on “live” (production) networked systems.
What is Electronically Stored Information (ESI)?
ESI can be data from any electronic device that saves information from cameras to computers to mobile devices and almost anything in between capable of storing digital information. Extracting this data could provide specific critical information for your matter.
What devices should be held for discovery?
Any device capable of storing digital data including:
- Desktop computers
- Laptop computers
- Phones
- USB drives
- Digital video storage devices
- Video game consoles
- Cameras
- MicroSD, CF, MMC (et. al.) cards
- Video Surveillance Systems
- Phone Systems
How can an individual prepare mobile devices and systems for electronic collection?
- Mobile devices can be in “Airplane” mode and wrapped in aluminium foil until a forensic examiner can take possession.
- For onsite collections, Computers should remain in their current state (ON or OFF)
- Computers sent to Carolina Computer Forensics should be fully powered down (shutdown) and disconnected completely.
What information will be needed?
- You MUST ensure that you have the right to request an examination and extract information from the data source. Carolina Computer Forensics will adhere to applicable federal, state and local laws in addition to any provided legal notices.
- Passwords for both the device and online storage systems.
- Knowledge of the information you are interested in obtaining.
- Relevant keywords and other search criteria (ex. Email addresses, dates)
- Signed agreement authorizing our digital forensic examiners to initiate work on your behalf.
What kind of information can be discovered from electronic devices?
- Pictures
- Text messages
- Location (GPS) information
- Timeline information
- Active or saved files
- Deleted or recovered files
- Device information
- Contacts
- Notes
- Data files
- Email
What should the organization do to preserve the data?
- Secure the device so that it cannot be tampered with in any way.
- Document all relevant user information.
- Maintain strict control of the device.
Where does The Carolina Computer Forensic Group look for data?
- Network storage
- External storage drives (thumb drives)
- Mobile devices
- Laptop and Desktop Computers
- GPS enabled devices
- Cameras & Digital Video Recording (DVR) devices
- Video gaming consoles
- Other items capable of connecting to Internet resources (Internet of Things / IoT)
What is Metadata and how can it be used? (searches - non-content)
- Metadata is data about data such as where, when and on what kind of device a digital photograph was taken. In criminal and civil cases it may be critical to know the GPS coordinates of a photo, what the actual date and time of the photo was, and the kind of camera used.
- Log servers that record information about a network could be critical for determining the online habits of internal users that may not be exposed on the computer itself.
- PBX logs can show various information regarding the office phone system it’s use.
- Email servers (logs) can show activity for individuals not apparent within the email databases themselves.
What kind of criminal cases can benefit from digital forensics or ESI?
- Child abuse
- Financial Fraud
- Intellectual Property theft
- And others
What kind of domestic cases can benefit from digital forensics or ESI?
- Marital fidelity
- Child custody disputes
- Activity of minor children
What is Mobile Forensics?
Discovery, extraction and analysis of the following:
- Text messages
- Voicemails
- Photos
- Contacts
- Log Files
- Apps
- Call History
What is a Chain of Custody and how is it important?
The Chain of Custody defines the specifics of who has had control of a device and how it was passed from one person to another and for what cause. Proper documentation of this information can be critical in litigation and helps ensure the integrity of the stored data.
What kind of devices have digital images and how are they searched and recovered?
Digital Cameras, Desktops, Laptops, Phones and other devices may contain digital images not only of pictures acquired intentionally but also acquired while browsing the internet. These images can provide significant insight into the habits and interests of the user and serve as evidence in court cases.
What are Keyword searches / search terms?
Keyword searches involve looking for information specific to a particular thing like an email address, name, destination, or business. Date ranges can be applied to search terms and keyword filtering to narrow the scope of data collection and data production.
What is Timeline analysis?
Timeline analysis involves using the metadata regarding time stamps on certain files to establish activity over time like how often someone visited a certain website, contacted a certain person, or visited a certain place.
What is Email discovery and recovery?
Email discovery and recovery deals with the acquisition of known and unknown email data stored on corporate systems and local computers. This can involve directly interacting with the networked servers or through a remote connection as well as imaging local computers for quarantine of email streams used outside the sanctioned corporate environment. Processing of this enormous amount of data requires specialty software, dedicated hardware, and experience that The Carolina Computer Forensic Group can provide.
