Computer Evidence Recovery
Currently, between 25% and 35% of all important discovery documents are resident on computers.
In both civil and criminal issues, there are times when you know or suspect that there is electronic data on a computer hard drive or tape that has been hidden, tampered with, deleted or otherwise damaged, and you need the information. Whether the cause is a disgruntled employee who "wiped out" his computer before leaving or individuals trying to hide evidence of fraud, sexual harassment or embezzlement, or trying to hide the misappropriation of customer files, proprietary processes or customer lists, the process of recovering the information is similar.
If you believe that you have a computer that that contains electronic evidence, discontinue it’s use immediately. If it was left running, leave it on, if not, leave it turned off. Attempting to access the computer in any way, may change the data contained in the drive or activate a pre-programmed set of instructions to alter the content of the drive. Continuing to use the computer can also innocently overwrite the evidence making it permanently unavailable.
In many cases the electronic evidence is still on the hard drive and requires skill and experience in data recovery and computer forensics to identify and retrieve the key data. Our experts can safely enter any system, network or data storage device to recover data and determine whether it has been tampered with, deleted or damaged. Depending upon your needs, experts can search for specific data, phrases, files, numbers or keywords; determine when data was accessed; or verify illegal use of proprietary information.
The sure way to assure that all available electronic evidence is secured, is to isolate the hard drive or tape involved and secure it in such a way as to satisfy, in court, that the original data was not modified. Ideally, remove the hard drive(s) from all computers involved.
Be sure of your expert! If an attempt has been made to delete, erase or otherwise hide critical evidence, it is very important that an experienced, data recovery professional search for, and retrieve the missing information. There are many excellent software products on the market, which when used as designed, can recover lost or hidden data. However, these software products can also permanently lose data which otherwise could be recovered. You are risking your one chance of recovering critical information by using commercial software. If you have lost data that is critical, search out a competent data recovery professional. Data Recovery Group is that competent professional.
Preserving Evidence
Before starting to search for evidence on a hard drive or tape, we first "clone" or "bit map", cluster by cluster this original drive, to one of our drives. All bits and bytes on the original media are now duplicated, without changing any structure or information. This is a different technique than using the copy command, which can eliminate key information still on the drive.
Working closely with our client we can use cloned drive to identify any erased or deleted files including the date and time the file was generated or the date and time the erasing or deletion took place.
Using key word search techniques (not synonymous with the "find" or similar command in many operating system software) we can search for key phrases, words or numbers in every file.
Let us use our experience in recovering data for over 5,000 companies and law firms to work for and with you.
Our experts will work with you! We use proprietary techniques to evaluate the information on a drive — without effecting any action to modify the information. You let us know what you are looking for, and if the information is on the drive, we can answer your questions.
If the information is available, we can get it for you.
