An
exact ‘fingerprint’ of
the media or storage
will be determined and
verified
A
‘bit by bit’ copy will
be made of the hard
drive or evidence media
and verified against the
‘fingerprint’ of the
original evidence.
All
examination procedures
will be performed on the
copy of the original
evidence. This will
ensure the integrity of
the original evidence.
Identify leads and
computer evidence
contained in files and
slack space, which can
determine the outcome of
the investigation.
Document the findings
and provide expert
witness testimony, if
needed, to help clarify
technical computer
issues in the litigation
process.
Deleted data, hidden
data, and
password-protected data
can be retrieved in many
instances. HCF can find
data on a formatted hard
drive, deleted e-mail,
intentionally altered
data and in some cases
media that has been
physically damaged. The
recovered data is then
carefully documented,
analyzed, and recorded
in reports which are
presented to the client
and/or in litigation.
