Digital evidence is fragile, and must be protected. This is not a sales pitch. This is not a scare tactic. This is not an exaggeration. It is a hard-core scientific fact that merely booting up a computer without the use of strict forensic procedures, will alter the evidence on that machine. If there's a chance that a computer contains evidence, don't touch it. We of course recommend that you call Evidence Technology as soon as possible, but in the meantime, there are procedures you should follow to afford maximum preservation of any existing evidence. Click here for those procedures. Or click the 'more' link below to proceed to the next page in the computer forensics learning center.
Q: What do you mean by "examining data...within the context" of our
situation?
A: Context can radically change the meaning of information. One of our
favorite examples is from the Bible: Judas...went and hanged himself. Go, and
do thou likewise. Whoa! The Bible is of course not instructing us all to go
out and hang ourselves—instead, two passages have been taken out of context and
combined to create something ominous and wholly inaccurate. Context matters.
Imagine finding the following line in an email on a company machine: See you tonight. Don't worry, we'll work it out. If that was sent from an employee to his wife, it might not be the best use of a workplace computer, but it would seem pretty harmless. What if, however, it was in an email to an R&D operative from a competing company? Again, context matters. At Evidence Technology, we talk with you beforehand to get an understanding of your situation, and what kind of information might be relevant. We then use sophisticated analysis to examine the evidence in context.
Copyright 2004, Evidence Technology, LLC, All Rights Reserved
