Have you heard about our cost effective “snapshot” evidence preservation service? Did you know we can assist you with an evidence preservation letter to prevent the opposing party from destroying data?

DataClues can conduct computer forensic examinations that meet the individual needs of the client. This can be on most types of computers, including your servers. There are different phases, or levels of examinations, and based on your specific needs each type will be discussed during the initial consultation. There is no charge for your initial, confidential consultation but please note; we do not provide criminal defense work.

Computer forensics may be performed on almost any type of media, or device capable of storing data such as servers, workstations, laptops, hard drives, digital cameras, palm size computers, laptops, and PDA's (personal data assistants) such as Palm Pilots. Please contact us to discuss your specific needs.

Computer Forensics may be used in almost any type of situation. Situations that may benefit from the use of computer forensics can include:

Intellectual Property Issues:
Did your ex-employee steal the customer database and furnish it to your competitor? Did you know the computer can leave traces of files being e-mailed, or sent to removable devices such as floppy disks or external hard drives?

Trade Secret Violations/Infringement:
Have you recently found your trade secret in the hands of a competing company? If you are planning on taking them to court to settle the dispute wouldn’t it be nice to gain the evidence from THEIR computers to support your claim? If it’s source code (computer programs) in question we can make a byte for byte file comparison to establish incriminating similarities to YOUR trade secret(s).

Wrongful Termination Lawsuits:
Are you facing potential litigation for wrongful termination? We have helped several companies bring this to a fast and favored resolve by simply finding evidence on the computer to support the termination. Such evidence may include unauthorized viewing of adult pornography or incriminating e-mail communication showing the knowledge of policy violation by the ex-employee.

Internet Related Issues:
Has someone intruded upon your network? We have been approached by some large corporations asking for our help in identifying traces left behind by hackers. Some of the critical information needed was, what port was victimized, what was the method of attack (e.g. which virus or Trojan), and most importantly, how bad was the intrusion? We have even been successful in finding the hacker tools that were deleted by the unauthorized visitor.

White Collar Incidents:
Clients have used us in several cases where criminal prosecution was not desired. Their goal was to settle it in the civil arena while maintaining confidentiality. We respect your desire for privacy and understand the need to protect your corporation from unwanted publicity.

Most Other Civil Issues:
We have listed just a few examples for you to gain an idea of how computer forensics can help you. Even though you may not see your specific situation listed please contact us discuss your specific needs.


Examinations Levels:

Preservation For Later Analysis – Level One
A client may not be sure which type of examination they want, if any, during the initial consultation. The most important thing to remember is to protect and preserve the evidence no matter what the final outcome. If you choose not to preserve the evidence now it may be altered or destroyed when you need it. DataClues offers the ability to preserve the evidence by making an exact copy of the desired media. This will give the client the piece of mind knowing the evidence has been preserved in the event they later decide to conduct a forensic analysis. If so desired, you can opt for our data storage service for your newly created forensic image until your matter is resolved.

Preview Analysis – Level Two
One method of examining media is to preview it. DataClues has the expertise to employ different types of previews based on the circumstances of the incident. This method allows the original media to be viewed, without alteration. Although this is considered to be cost effective, it does not allow for an exact copy of the original media for later analysis. What you preview and recover at this time is what you will have forever. Previewing media can yield a significant amount of data such as specific documents, spreadsheets, and pictures. Although you can extract and save these specific files, the preview exam does not allow you to perform certain functions that may be needed by the client.

Examination and Analysis – Level Three
A standard and/or advanced examination involves the acquisition and analysis of the media. The acquisition phase involves making an exact copy of the original media without any alteration of the evidence. DataClues uses court accepted, industry standard programs to make an exact copy of the desired media. A bit by bit, sector-by-sector copy of the media is made, and the exact copy is used for the analysis. Acquiring and analyzing the desired media is the most frequent type of examination conducted. This allows for a much more comprehensive examination. It allows the examiner to find items such as specific files, whether active or deleted, operating system information and trace artifacts, data in areas not accessible by the operating system, date/time stamps, file shortcuts, and more. We can discuss which level of service best suits your needs during our initial consultation.