Electronic evidence discovery & data recovery

Trying to prove a computer crime can be complicated and time consuming. If the suspect deleted files and programs or reformatted the hard drive it could be almost impossible...

Computer forensics and electronic evidence discovery combines high tech data recovery techniques which can recover deleted files even from reformatted hard drives!

Like most crimes, crimes involving computers leave trails; electronic trails. But it takes trained forensics specialists to uncover this electronic evidence.

Electronic evidence discovery is not just printing out a list of computer files -as much as 30% of the data associated with the files isn't shown in the content. This includes time stamps, distribution lists, and receipt acknowledgement, which can be equally incriminating, if not more so...

By piecing together information from different areas of the suspect's computer network, one can obtain a comprehensive and thorough account of an event. And as Bill Gates found out, these records are often irrefutable.

And computer documents contain information not available in traditional forms of evidence, including date and time stamps, records of who sent and received a document and copies of previous drafts or versions

According to Computerworld magazine, over 30% of all discovery requests now include computer evidence - a number that is sure to grow...
...In fact,a computer system is often the best place to start looking for evidence. Computer records are essentially permanent, creating a uniquely long-term history of the activities surrounding an event.

***Approximately 65% of all e-mail messages are never printed onto paper, remaining digital. ***

A comprehensive discovery plan must be carefully developed to help ensure the admissibility of the evidence and avoid errors that can result in incomplete case preparation.

This includes:

Accessing deleted, hidden, or password-protected files within large networked systems;
Recovering data from out-of-date media or operating systems;
Analyzing the authenticity of files- knowing whether they have been changed or deleted;
Finding key files or records from vast fields of live data (e.g. e-mail records);

Redacting privileged information; and
Presenting that information in a legally compliant manner.

The Solution

ADR Computer Forensics and Electronic Evidence Collection Services have the tools and technologies for litigators to access this new dimension of "computer evidence". Our engineers have encountered and cracked virtually every system configuration in existence.

The use of electronic evidence in litigation follows four main phases: Discovery Planning, Evidence Discovery, Evidence Analysis, and Evidence Reporting.

DISCOVERY PLANNING

Advise on what types of evidence are likely to be found on suspect's network or storage media
Analyze password, encryption or storage systems
Determine locations of targeted evidence and define the most efficient set of data to search
Prepare discovery documents (RFP's, Interrogatories, Depositions, and Discovery Motions) to ensure the admissibility of the evidence

EVIDENCE DISCOVERY

System Overview to identify the locations of the targeted evidence
Restore records from unreadable to accessible formats
Produce all targeted files from active and stored data, including deleted, password-protected or hidden documents

EVIDENCE ANALYSIS

Key-word search of databases for relevant documents (identifiable by sender, dates, or content)
Redaction of undiscoverable (i.e. privileged) information from documents
Data authenticity or integrity analysis

EVIDENCE REPORTING

Customized evidence reports per case needs
Expert witness testimony

ADR Computer forensics, evidence collection, examination and analysis is unparalleled in integrity, quality and reliability. We can help you determine where to look for key evidence, offer expert witness and provide you with the capability to recover and analyze electronic evidence. Extensive experience with electronic evidence in litigation, lets us bridge technology and litigation so you can concentrate on the evidentiary power of computer information.

Computer Forensics Services