Nationwide Computer Forensic Investigators - Expert Data Investigation & Analysis

Data investigators handle the process of imaging and analyzing computer hard drives and other electronic media in a forensically sound manner. Our nationwide forensic examiners and investigators can recover electronically stored information (ESI) from a variety of media including hard drives, floppy diskettes, zip disks, tapes, PDAs, CDs and DVDs, USB and other removable drives, digital cameras and recorders, flash cards, network servers and cell phones.

Acquiring ESI that may be relevant in litigation or investigation requires planning, as there is a risk of spoliation as a result of inaccurate collection. There are many requirements for the proper collection of ESI, ranging from preserving metadata and establishing chain of custody to maintaining data integrity.

CloudNine Discovery, through strategic alliances with nationwide computer forensic experts, provides computer forensic examination in Texas and all other major cities across the US.

Download a copy of CloudNine Discovery's - Forensic Data Collection Key Questions.

Understanding the data collection scope and type of data available for collection allows effective data acquisition. Scope Questions Generally Include:

  • Who are the custodians of interest?
    • Based on specific document requests?
    • Based on geography, department, or job function?
  • Data types of interest? (Email, File Server, Hard Drive)
  • What are the dates of interest?
  • Must deleted files be produced?
  • Are backup tapes within the scope of the project?
    • If so, must all tapes be restored or just a portion?
    • If so, are monthly, quarterly, or yearly backups acceptable?
  • Are the current in-house IT staff qualified to handle the work?

Our nationwide computer forensic experts can assist in developing a collection plan starting with identifying the types of data and the locations. Collection projects may involve some or all of the following:

  • Local drives including desktops or laptop file systems, network file shares, portable media (CDs, DVDs), external hard drives and portable devices (flash drives).
  • Live networks including e-mail servers, such as MS Exchange, or other database applications.
  • Backup media storage including backup tapes and portable (off-site) storage devices.

Accurate data collection and acquisition requires solid planning for maximum effectiveness. The following questions will help determine where and how electronic evidence is stored.

Email Collection Sample Questions:

  • What types of email servers are deployed throughout the organization?
  • Where are the mailboxes of the relevant custodians?
  • What are the email server policies regarding deleted items?
  • How long is email allowed to stay on the server?
  • What are the mailbox size limits?
  • Do users archive their email?
    • If so, to their local computers or a file share?
  • How are the email servers backed up?

File Server Collection Sample Questions:

  • What types of file servers are deployed throughout the organization?
  • Do users have home directories? If so, on what servers?
  • What are the size limits for each user?
  • Does the organization utilize shared folders?
    • How are shared folders organized?
    • By department, geography, or job function?
    • Are they accessible by all employees?
  • How are the file servers backed up?

Hard Drive and PDA Collection Sample Questions:

  • Number of laptops and desktops?
  • What operating system is running on the laptops and desktops?
  • Size of the hard drives? (Ex. 40GB, 80GB, etc)
    Are the hard drives or data encrypted?
  • Are PDAs or any portable devices used?
    • If so, what models / types?
  • Is any data stored on personal or home computers?

Blackberry, iPhone, Android / Smartphone Collection Sample Questions:

  • Should we preserve active content, specifically active SMS messages?
  • Would we need to preserve the slack space on a smartphone device?
  • Do we need to restore previously deleted email and messages?
  • What time frame do you need these tasks performed in?

Please contact us at 713-462-6464 or click here to speak with one of our nationwide computer forensic investigators.

Services: Experts in eDiscovery

What you get with CloudNine Discovery

Self-Service eDiscovery

Easy to Learn and Use Apps

Simplified Pricing with No User Fees

Secure Tier IV Data Center

Service that Puts our Clients “on cloud nine"

Share This Page:

Latest eDiscovery Daily Posts:

Subscription Center:

Sign up to receive eDiscovery Daily's articles via email or add the RSS feed to your newsreader of choice.

  • RSS Feed