Our Process
The process we use to conduct investigations can be broken down into several parts as displayed below. Each part of our unique system ensures proper handling of evidence in a safe, secure and organized fashion.
Consultation
Starting with the first meeting with clients, we are able to discuss the various services that may be valuable. Focused on the goal of the investigation, we can proceed to the next phase.
Data Collection
As soon as the evidence drive is acquired, two unique MD5 and SHA1 hashes are generated. This allows 100% proof that the integrity and authenticity of the drive has not changed froms tart to finish. The evidence drive is then imaged onto two separate drives, both contai ning the same hash values. After this point the evidence drive is stored securely, along with its chain of custody.
Recovery and Analysis
Using out court and industry proven tools,. we are able to discover all relevant information stored on the media. See the Services tab for a complete listing of the services we provide. MD5 and SHA1 hashes are generated once again to confirm no data has changed on the media from start to finish of our investigation.
Results and Reporting
All data found during the investigation will be gathered in a final report, providing both the evidence acquired and the details regarding each item.
Affidavits and Testimony
The final phase allows us to either provide an Affidavit concerning the findings or testify in court. All evidence obtained will be cited, along with our analysis in this legal testimony.