Nationwide Computer Forensic Collection and Investigation - Expert Data Collection & Analysis

Data acquisition is the process of imaging computer hard drives and other electronic media in a forensically sound manner. Our nationwide forensic examiners can recover electronically stored information (ESI) from a variety of media including hard drives, floppy diskettes, zip disks, tapes, PDAs, CDs and DVDs, USB and other removable drives, digital cameras and recorders, flash cards, network servers and cell phones.

Acquiring ESI that may be relevant in litigation or investigation requires planning, as there is a risk of spoliation as a result of inaccurate collection. There are many requirements for the proper collection of ESI, ranging from preserving metadata and establishing chain of custody to maintaining data integrity.

CloudNine Discovery through a strategic alliance with McCann Global, a Houston based investigation company (License Number: C15690), provides computer forensic examination in Texas.

Download a copy of CloudNine Discovery's - Forensic Data Collection Key Questions.

Understanding the data collection scope and type of data available for collection allows effective data acquisition. Scope Questions Generally Include:

• Who are the custodians of interest?
  • Based on specific document requests?
  • Based on geography, department, or job function?
• Data types of interest? (Email, File Server, Hard Drive)
• What are the dates of interest?
• Must deleted files be produced?
• Are backup tapes within the scope of the project?
  • If so, must all tapes be restored or just a portion?
  • If so, are monthly, quarterly, or yearly backups acceptable?
• Are the current in-house IT staff qualified to handle the work?

Our nationwide computer forensic experts can assist in developing a collection plan starting with identifying the types of data and the locations. Collection projects may involve some or all of the following:

• Local drives including desktops or laptop file systems, network file shares, portable media (CDs, DVDs), external hard drives and portable devices (flash drives).
• Live networks including e-mail servers, such as MS Exchange, or other database applications.
• Backup media storage including backup tapes and portable (off-site) storage devices.

Accurate data collection and acquisition requires solid planning for maximum effectiveness. The following questions will help determine where and how electronic evidence is stored.

Email Collection Sample Questions:

• What types of email servers are deployed throughout the organization?
• Where are the mailboxes of the relevant custodians?
• What are the email server policies regarding deleted items?
• How long is email allowed to stay on the server?
• What are the mailbox size limits?
• Do users archive their email?
  • If so, to their local computers or a file share?
• How are the email servers backed up?

File Server Collection Sample Questions:

• What types of file servers are deployed throughout the organization?
• Do users have home directories? If so, on what servers?
• What are the size limits for each user?
• Does the organization utilize shared folders?
  • How are shared folders organized?
  • By department, geography, or job function?
  • Are they accessible by all employees?
• How are the file servers backed up?

Hard Drive and PDA Collection Sample Questions:

• Number of laptops and desktops?
• What operating system is running on the laptops and desktops?
• Size of the hard drives? (Ex. 40GB, 80GB, etc)
  Are the hard drives or data encrypted?
• Are PDAs or any portable devices used?
  • If so, what models / types?
• Is any data stored on personal or home computers?

Blackberry, iPhone, Android / Smartphone Collection Sample Questions:

• Should we preserve active content, specifically active SMS messages?
• Would we need to preserve the slack space on a smartphone device?
• Do we need to restore previously deleted email and messages?
• What time frame do you need these tasks performed in?

Please contact us at 713-462-6464 or at info@cloudninediscovery.com to speak with one of our nationwide computer forensic investigators.

• OnDemand
• Services
  • Computer Forensics
    • Computer Forensics Consulting
    • Forensic Collection & Investigation Services
    • Backup Tape Restoration Services
    • Password Recovery/Cracking/Decryption
  • FirstPass Early Case Assessment
  • eDiscovery
  • eDiscovery Review
  • Data Conversion
• Culture
• Support

What you get with CloudNine Discovery

© 2011 Trial Solutions of Texas, LLC. OnDemand, OnDemand Discovery, CloudNine Discovery, FirstPass, Trial Solutions, and ImageDepot are trademarks owned by Trial Solutions of Texas, LLC. All Rights Reserved (Terms, Privacy)