© Computer Forensics Expert Witness
Planning
When taking an irregular or new
route, the development of a plan
enables the computer forensics
expert to travel at the shortest
distance, while gaining information,
related to the matter. This requires
the ability to interface with
attotneys, clients law enforcement
and the courts, in order to help
prepare pleadings and make
arrangements for pre-trial hearings.
As yur expert, I will be sitting with
your attorney to plan out a game
plan, for your matter.
Acquisition
Part of our arsenal is a very well
equipped set of both hardware and
software tools. These include tools
from Access Data, Tableau
Weibetech, Logicube and otheres,
to acquire the data. In some cases,
law enforcement will perform the
imaging of the source data, for
defense review.
All materials have licenses and
except in very few cases, new
hardware and software purchases,
are a rarity, but does happen, such
as hard drives.
Examination
The purpose of the computer
forensics examination process is to
extract and analyze digital
evidence. (NIJ) We utilize forensics
software which examine various
parts of the computer's hard drive
for exculpatory data. We utilize
various software tools that are
recognized by the courts as to
accuracy and content.
As your expert, we take it deeper, to
find the root causes, any oversights
or other anomalies, within the
evidence they have collected.
Analysis
The interpretation of the recovered
data and putting it in a logical and
useful format. (NIJ) - Consultation
occurs with client and counsel, for
the preparation of deposition,
pretrial hearings and trial
preparation materials.
This phase is where all of the
examination work is reviewed,
timelines are contructed, and other
relationship diagrams and artwork is
integrated, which will be
incorporated, as exhibits.
These documents are not only
based upon the examination phase,
but research and experience will
also be incorporated into the
exhibits used in the “Documentation
and Reporting Phase.”
Documentation & Reporting
The Documentation and Reporting
Phase integrates the computer
forensics reports, relevant data and
computer forensics trial exhibits, as
needed, based upon the output
from the computer forensics
examination and analysis phases.
These include timelines, artwork,
narratives and so forth.
Time Drivers
There are a number of time drivers,
that push the hours dedicated to the
matter. These include, but are not
limited to:
•
Multiple hard drives.
•
Amount of data to be
processed.
•
Time to obtain protective and
court orders.
•
Pre-trial hearings.
•
Unavoidable delays.
Again, everybody does their best to
accomodate, the best way we can.
Computer Forensics Expert Services
Why should you select Computer Legal Experts as your Computer Forensics or computer
forensics expert Witness Service Provider?
Since 1984, we have been recognized as "scientific subject-matter experts" in the area of computer forensics, computer crime
investigation and Expert Witness Testimony.
We use the similar tools, if not superior in nature, that are employed by most Federal, State and Local Government law-
enforcement agencies when conducting an incident response or an investigation. Our experience includes matters pertaining to
E-mail Discovery, Electronic Discovery, Child Custody, Spousal Support, Computer Crime, Peer-to-Peer (P2P) and e-mail
discovery.