Experts in Electronic Discovery & Digital Forensics
Efficient and effective Electronic Discovery & Digital Forensics begins with the preservation of Electronically Stored Information (ESI). For both large & small businesses, preserving ESI should be a routine, prophylactic action conducted prior to litigation as part of an information management plan. Unfortunately, preservation is most often employed on an irregular basis in response to discovery requests during civil litigation. As a result, critical metadata (the properties & attributes of a file) is often lost - most often due to changes in the status or condition of a file itself.
In criminal matters, preservation of digital evidence is the responsibility of law enforcement. Mr. Penrod most often conducts criminal defense examinations at law enforcement facilities. When contraband images are not part of the evidence, law enforcement will normally produce copies of the digital evidence in discovery to Mr. Penrod for examination at his lab.
Regardless of one's situation, from the initial design of a plan to preparing for trial, PenrodEllis FDD can help.
COMPUTERS & OTHER DIGITAL ELECTRONIC DEVICES
PenrodEllis FDD can extract mathematically authenticated forensic images from the digital devices listed below. For more information about them, click HERE.
Computers, such as network servers, client workstations, & personal desktop/laptop computers
Storage Devices, such as hard-disk & solid-state drives, removable USB keys & flash cards, portable & desktop USB drives, & network storage arrays
Mobile Devices, such as smartphones, mobile phones, tablet computers, & e-book readers
Network Devices, such as Internet modems, unified security gateways, network routers, & WiFi access points
Multimedia Devices, including digital cameras, video recorders, & music players
Television Appliances, such as cable & satellite DVRs, & streaming video players
ELECTRONICALLY STORED INFORMATION
PenrodEllis FDD can examine the following types of Electronically Stored Information (ESI). Click HERE for more information.
File systems, such as FAT32, NTFS, HFS+, APFS, & HPFS
Operating systems, such as Windows, MacOS, Linux, Android, & iOS
Active & Latent ESI, including file content (data) & properties (metadata), as well as intact & partially overwritten deleted, temporary & discarded files
Office Documents, such as word-processing files, spreadsheets, presentations, & publications
Electronic Communications, such as email, chat, & text messages
Internet Access Records, such as web browser databases & P2P client files
Logs, which include system event, user activity, file usage, & audit trail records
Forensic examiners preserve ESI by extracting authenticated forensic bit-stream images from the storage components of computers, appliances, & external drives. Forensic imaging captures all active & latent ESI on storage media. A forensic image (often called a mirror image) preserves that ESI as it existed at the time of its extraction & safeguards its integrity. A mathematically verified forensic image is the foundation that establishes recovered data & metadata as legal evidence. Courts throughout the world accept forensic images as authentic representations of the original ESI on a storage drive, allowing experts to submit evidentiary ESI in hearings and at trial. For this reason, forensic recovery of ESI is only rarely conducted against "live" computer systems and storage devices. The forensic bit-stream image is the only source of computer evidence presented at trial.
PenrodEllis Forensic Data Discovery
200 South Wilcox Street, Suite 327
Castle Rock, Colorado 80104