It's not the Emmy Award-winning “CSI: Crime Scene Investigation,” but
computer forensics holds a growing lure for law firms an
An employee needs to be disciplined for
violating Computer Use Policies, but you want solid evidence to protect
yourself from litigation. Or, you suspect someone of taking intellectual
property (sales leads, customers, payroll info) via email, thumb drive or even
This is where Digital Forensics Services
It's not the Emmy Award-winning “CSI:
Crime Scene Investigation,” but digital forensics holds a growing lure for law
firms and human resource directors investigating workplace disputes.
In this day and age, there are a multitude of electronic
storage methods. The obvious are computers, and more recently the list
- Thumb drives
SD, CF, etc. cards
And the list is growing daily.
At Quisenberry and Associates, Inc, we work daily on
safeguarding data stored on these devices, and analyzing and discovering data
on the devices.
Preservation is important. For example, simply backing up a
hard drive may cause you to lose some pertinent data. “How?”, you may ask.
Well, normal backup procedures backup the drive based on what is in the
Directory. So, a backup will backup all data that is reported in the File
Directories. But, most disk drives are not 100% full. So, if a drive is 50%
full, a backup will save 50% of the data (the data represented in the
Directory). The other 50% will not be retained. The 50% not in the directory
usually has old deleted files, and other artifacts.
We image the disk or device on a byte-by-byte level, in a
way that the original disk in not affected, so when we have completed the
imaging we have an exact copy of the original disk or device. This way we
preserve all of the data, and then you are able to continue to use the device
We follow proper procedures for data preservation and chain
of custody records, so the data is safe and secure.
preservation has become more and more important for business due to new
amendments to the Federal Rules of Civil Procedure, which took effect about a
year ago. The new rules address standards of evidence for “e-discovery,” or
electronic records that are admissible for civil cases in federal courts.
Our current caseload involves intellectual-property disputes, theft of trade
secrets, employee misconduct and civil claims.
A part of our employee misconduct cases involve sexual harassment in the
workplace and Internet pornography on work computers.
Quite often, we get word from an employer that might have just fired an
employee and we're expecting a dispute or something that might come up, so we
need to preserve evidence from the time of a person's employment. Or, we might
hear that they feel they have a set of reasons to fire someone, and now we need
to prove it (before they proceed).
Services range from a simple “preservation” job of storing a copy of the data
on a single computer, to up to an extensive investigation of a massive computer
A common mistake employers make, is to rely on an internal employee or
information technology department not trained in computer forensics to preserve
e-mails or other records.
Any additional activity on a computer file can be subject to scrutiny or
cross-examination in court.
With paper and print documents, it was always very easy to destroy the evidence.
Now with electronic data, there are copies and it's much harder to destroy, but
it's very easy to change the records. That's why the preservation side of this
business is so important.
- Forensic Imaging of Disk Drives
Imaging of Thumb drives, Cell Phones, Ipods, etc.
and Reporting on Imaged Data
Recovery for encrypted data
Reasons to need the
Harassment (via email, etc.)
Harassment (via email, etc.)
Intellectual Property Theft
Safeguarding Data for future issues
For Digital Forensics Services Inquiries.
Fax : 714-782-6087