Computer Forensics FAQ
When a file is deleted from the computer where does it go?
What can a computer forensics specialist do?
Why should we hire a computer forensics specialist when there are already computer personnel in our company?
We don’t care about our data being admissible in court. Can’t we use in-house computer staff just to monitor employee usage?
What do you look for in a computer forensics specialist?
Can investigations be conducted without removing the computer equipment from our office?
What happens when the disk is reformatted? Can evidence still be recovered?
We suspect that illegal activities are being conducted through employee workstations. Can you help in this area?
When a file is deleted from the computer where does it go?
When a file is deleted from a computer, it means that the space that was previously taken up by that file is now deemed by that computer as available for other information. The file remains in the computer until the space is needed and the file is overwritten. Often, the file remains on the machine in whole or in part indefinitely and can be recovered.
Back to Top
What can a computer forensics specialist do?
The most important factor in any computer forensics investigation is ensuring that the evidence does not become altered during the course of the investigation. Computer forensics specialists are trained to retrieve or analyze data while retaining the integrity of the machine that is being investigated. Often, a computer forensics specialist can prepare a mirror copy of the data being retrieved or analyzed for presentation in court or on-site evaluation of data.
Back to Top
Why should we hire a computer forensics specialist when there are already computer personnel in our company?
Although your current staff may be knowledgeable in networking and computer usage, it is not likely that they will have the specialized knowledge of procedures involved with forensic examination. If your data is analyzed or recovered without using the proper forensic methodology, the resulting information could be inadmissible in a court of law. Our computer forensics specialists use targeted hardware and software to ensure that you receive the most thorough examination of computer data possible, while preserving the integrity of the information found.
Back to Top
We don’t care about our data being admissible in court. Can’t we use in-house computer staff just to monitor employee usage?
If improper computer usage by your employee is discovered, it will likely end in termination of that employee, followed by civil litigation. Using our computer forensics specialists will ensure that the information recovered regarding this employee is documented properly, and will also add the weight of expert testimony to your case if necessary.
Back to Top
What do you look for in a computer forensics specialist?
When choosing a computer forensics specialist, determine whether or not the individual has previously been accepted in court as an expert in computer forensics, and if they can provide references from attorneys that have used their services in the past. Also determine if they are members of computer forensics related organizations and if the software that they are currently using for data examination is up to date.
Back to Top
Can investigations be conducted without removing the computer equipment from our office?
Yes. We offer on-site acquisition services for this very reason. We understand how removal of vital computer systems can upset business operations. Therefore, we make ourselves available to conduct searches and investigations on-site, allowing for little to no down-time to your systems.
Back to Top
What happens when the disk is reformatted? Can evidence still be recovered?
It depends on the type of formatting imposed. More often than not, the disk has been reformatted using format tools that came with the operating system. Formatting with these tools will remove the references to data from the File Allocation Table but it will not overwrite the data present on disk. Although the operating system can no longer read this data, we can using specialized software. There are also many third-party format tools that accomplish low-level formatting that "zero-out" the disk. This makes it impossible for technicians to recover the data. Upon initial inspection, our technicians can determine what type of formatting has been used and to what extent the data can be recovered.
Back to Top
We suspect that illegal activities are being conducted through employee workstations. Can you help in this area?
Yes. We can conduct internal investigations discretely without the employee's knowledge. However, employee rights are controversial. Investigation of such matters without due cause can often violate these rights. At Kessler International, we work closely with legal counsel to guarantee that the investigations we conduct are justifiable in a court of law.
Back to Top
|
|
