Digital Forensics consists of the recovery and investigation of material found in digital devices, often in relation to computer crime or complaint. The term digital forensics was originally used as a synonym for computer forensics but has expanded to cover investigation of all devices capable of storing different types of digital data. Forensic Specialists will often refer to Digital Forensics as a collection of data from the past.
Understanding the Digital Forensic process:
The Digital Forensic process is a recognized scientific and forensic process used in digital forensics investigations. Forensics can contain a number of steps from the original incident “alert” all the way through to reporting of findings. The process is predominantly used in computer and mobile forensic investigations and consists of these 3 steps:
Acquisition: This process is also known as “Forensic Imaging”. Using state of the art hardware and software methods, Forensic Specialists will use a device commonly called a “write-blocker”. A write blocker allows data to be “cloned” to a secondary source that has been prepared by sanitizing the device before its use. For example, a brand new hard drive that has never been inserted into a computer will still contain elements that may invalidate the forensic data that been copied to it during the forensic process.
Analysis: Once the Acquisition has been verified, the Analysis process consists of mounting the forensic image to a forensic computer. Some forensic computers are rated server level, but normal computers can be used as well. When an investigation of a hard drive is being conducted, often the speed and power of a server is used to allow the forensic image to be searched quickly and diligently.
Reporting: The key component to completing the case involves Reporting. Reporting can consist of data extracted from the forensic image but may also include elements that the investigator witness when investigating the evidence. Reports can be in Acrobat, Excel, or even Word formats.
PM Investigations offers Digital Forensics:
If it’s a hard drive, flash drive, cellphone, DVD/CD, or any other type of digital storing media, PM Investigations can offer you or your client ways to locate and extract the information you seek. We have an array of hardware and software tools at our disposal and can even create custom tools if needed.
