The Ashkelon Group: Forensic Services
With over 90% of the world’s business documents being drafted on computers and the relentless use of email, instant messaging and Internet business by nearly everyone, much of today’s civil litigation evidence can be derived from computers. Computer Evidence Recovery has a computer forensic investigation team with the ability to locate and recover any and all relevant information or traces of same that may exist on a computer or storage device. This includes recovering items such as emails viewed but not saved, websites visited, deleted documents, uninstalled software and so on. Besides corporate or commercial applications, how much information exists on a personal computer at home? How about every webpage you have ever visited, and every picture on every one of those pages? Banking information, login information to secure sites such as chat, newsgroups, email, personals, back portals to work networks and more. It doesn’t take much to see the possibilities.Unlike a piece of paper which only shows us what we can see, electric data can provide information about it’s creation, multiple versions of that information, who it was transmitted to, a history of use and more. We are proud to say that if a piece of information exists on a computer or storage device, we will be able to locate it and produce it for inclusion in evidence.
This type of computer forensic investigation should not be confused with the type of searches the average IT employee or computer consultant will conduct. We employ a number of methods and investigative tools to locate and reconstruct each file or fragment, often including deleted items and fragments that other IT Consultants reported did not exist. Many of our clients, as well as the opposition, are often surprised when we are able to find information that was thought to have been deleted or erased.
Computer Evidence Recovery’s Computer Forensic Investigations Experts specialize in conducting an exhaustive, detailed and accurate investigation of information derived from computers in Calgary, Alberta, Canada, and throughout the USA for attorneys, businesses and individuals. In addition, you can be assured of our qualifications, since our chief agent is one of very few computer forensics specialists to hold the designation of EnCase Certified Examiner, as well as Advanced Microsoft Windows Forensics Specialist.
One of the key elements in every data forensics procedure is time. Users may unintentionally or inadvertently overwrite evidence simply by continuing to complete their daily tasks. Our specialists will quickly and cost-effectively collect and preserve data or evidence that may have been deleted or become inaccessible through normal computing methods. Our specialists can determine if certain information exists and, if so, where it might be located.
DO’S AND DON’TS
Don’t – Turn off the computer if it is on.
Do – Isolate the computer, disconnect it from the network and secure the location.
Don’t – Allow your IT staff to search. Self-investigation will compromise or destroy evidence.
Do – Call an experienced data forensics team immediately, to determine the best course of action.
When the data storage media is recovered either on location or at our lab facility, an accurate audit trail commences. The media is immediately logged into a tracking system and a log is produced. This log, suitable for all legal proceedings, accompanies the media throughout the recovery process. Computer Evidence Recovery, Inc. employees who handle the media ensure the continuity of evidence by adding their name, signature, date and a detailed description of what was done.
