Forensics Services

Forensic Imaging. Investigators will thoroughly document and record the entire scene with digital photographs. Once the documentation is complete, physical collection can take place.

Essentially, acquisition is the physical process of forensically imaging a hard drive for transportation off-site. The image is copied to an “evidence” hard drive that is an exact copy of the original media commonly accepted to be a forensically sound and sterile.

Since the acquisition process is so invasive, it is important to ensure that the parent machine and hard drive are re-assembled correctly. As part of the final acquisition phase and after the re-assembly of the parent machine, the machine is started to ensure proper operation.

Chain of Custody Creation and Maintenance. The COC is a vital part of the data certification process. Without a viable COC, even the best data collection process is subject to failure due to lack of proof of traceable ownership. With a sound and detailed COC, the evidence is able to survive trial scrutiny. As part of our investigative services, we will prepare, maintain and certify the COC for all evidence for which retain ownership.

Deleted Files, Orphaned Files and Folders Recovery. Part of the forensic analysis of an evidence drive is the recovery of files and folders that have been deleted. These files and folders are not generally visible or recoverable without the aid of specialized forensically-qualified software such as FTK or Encase. As a service to our customers, we can always attempt to recover all deleted, orphaned or missing files and folders.

Data Retention. Data storage refers to the off-site physical storage of the hard drive copies that were made during the Acquisition process. These copies will be used to perform the investigation or data culling. All evidence drives are stored in a locked safe, behind a multi-layered card access system at the National Data Center in Atlanta, Georgia.

DTI takes data storage and retention seriously, and it is our top priority to ensure the safety and preservation of all of our customer’s data. As a low cost service to our customers, we offer the value added service of making an exact bit-for-bit copy of an evidence drive. The copied image drive serves as yet another layer of redundancy.

Data Searches. As part of the overall search process, DTI examiners are trained to assist our customers with all types of forensic evaluations including:

• Fraud, copyright violations and espionage
• Cyber Crime Investigation and Intellectual property theft

Expert Witness. The final piece in any professional forensic operation is the availability of a technical professional that can serve as an expert witness.

At DTI, every part of our forensic investigative process is founded on proven, trial-accepted techniques. We ensure the integrity of the investigation, avoiding shortcuts and employing only field-tested methodologies. Our specialists and forensics professionals can be made available for testimony to this effect as required.