Computer Forensics Investigators use specialized software to identify and restore formatted, corrupted, deleted or hidden files from computers or other electronic media while maintaining crucial data trails, time and date stamps using accurate chain of custody and controls. They often can obtain access to protected or encrypted data by using specialized software. They are able to untangle the web of data and analyze emails, Internet searches, file transfers, online account transactions and anything else a computer is used to do over the Internet.

These are some of the many devices that could potentially contain electronic evidence:

  • Servers
  • Computers
  • External Hard Drives
  • Laptops
  • iPads
  • Cell Phone/Smart Phones
  • USB Memory devices
  • Cell Phone Tracking and Historical Data
    • Cell phone tracking data can at times provide very powerful hard evidence. When the data points to a geographic area, this can be very compelling information.
  • User History and Timeline Analysis
    • Frequently in case that are of a domestic, civil, and/or criminal nature a timeline of user activity and timeline analysis can be critical. Who did what when on a computer or cell phone, and combined with other evidence to produce a sequence of user activity.

It is imperative to preserve the integrity of the evidence, and prevent further manipulation, deleting or modifying of such. A forensic image, will preserve the integrity of the evidence and prevent tampering, deleting or modifying of important evidence.

There are protocols that most every court requires for the admissibility of evidence. Please know that viewing evidence could change time and dates. This could result in the evidence being inadmissible in court. It is usually recommended that you have a trained digital forensics professional view, save, copy or try to find evidence. Strict protocols and procedures must be followed in order to use the evidence in court. Once information is collected and analyzed, Cover 2 Investigations will provide a report of the findings so they can be reviewed and discussed with the appropriate party in order to make the best decisions possible in how to move forward with your court case or investigation.

Preserving Electronic Evidence