Computer Forensics LargeComputer Forensics

Computer forensics is the application of investigation and analysis techniques to electronic evidence, with the goal of having the findings admitted to a court of law. This requires maintaining a documented Chain of Custody as well as interpreting forensic artifacts in order to recreate the crime scene. With consumers adopting the latest technologies as soon as they are released, the landscape of evidence bearing electronic devices is constantly changing. As a result, computer forensics examiners must keep pace with the latest training and techniques in order to correctly recognize and interpret current artifacts, which can establish the merits of your case. Whereas e-discovery typically involves searching through all of the available documents in a case, computer forensics includes all of the deleted files that are not readily accessible and which may have been destroyed months or years in advance. Typically smoking gun evidence is deleted or hidden inside obscure artifacts and not sitting in plain sight. This is where our clients find the most value in our computer forensics services.

Typical Cases

Due to the pervasiveness of email and other forms of electronic communication, all cases include some form of digital evidence. Cases where computer evidence plays an especially important role include:

  • Violations of corporate computer policies
  • Unauthorized access to confidential information
  • Theft of intellectual property or trade secrets
  • Employee misconduct
  • Harassment or discrimination
  • Piracy or copyright infringement
  • Embezzlement


  • A review of the opposition’s report and reexamination of the evidence
  • Recovery of hidden or destroyed data, including formatted hard drives
  • Discreet evidence collection
  • Crack encrypted or password protected files
  • A timeline of relevant events
  • Recovery of email, including web based accounts such as gmail, yahoo, and msn
  • Internet browsing history
  • Analysis of file metadata
  • Identify removable drives used to copy confidential files
  • Determine user activity or usage patterns
  • Authenticate electronic documents
  • Identify files uploaded or downloaded
  • Detect attempts to fabricate or destroy evidence


We examine all forms of digital evidence including hard drives, RAIDs, portable music players, optical discs (CD, DVD, bluray), USB thumb drives, digital cameras, and flash memory cards (SD, microSD, XD, CF).