Forensic Process

Our forensic process starts with a consultation (free of charge) to determine your needs and the parameters of your case. We help you to determine what is to be examined. Digital evidence can reside on desktop or laptop computers, external hard disk drives (i.e. USB or FireWire drives), servers, tape or optical drives, CDs or DVDs, media cards (i.e., SD or CF camera cards), USB chips (i.e., Privacy, Thumb or Travel Drives), PDAs (personal digital assistants), phones, etc., etc., etc.

The amount of digital evidence in a case can be staggering. One of the secrets to the process is to be smart about where and how to look. You can waste a lot of time and money searching for the "needle in the haystack".

We use established techniques and protocols along with state-of-the-art hardware and software. We have an in-house "laboratory" facility but can also initiate examinations in the field with our portable equipment.

The first actual stage of the forensic process is to acquire a forensic image. Whether your computer is a stand alone PC (Windows, Mac or Linux based) or an office-wide network server, we have experience imaging all scenarios. Forensic images are generally "bit for bit" or "bit stream" copies of the physical hard disk drive(s). This allows the examiner to search for all types of data including deleted or erased files. The forensic/imaging process assures that data is not modified or altered and is documented for court purposes (if necessary).

The second stage is the analysis of the image. Here experience and technique is key. Again, if you don't know what to look for the process can be a waste of time and money. We have experience recovering and extracting documents, spreadsheets, email (web and software based), photographs, instant messages, Internet activity (web pages), Internet history, contacts and user activity.

San Diego Computer Forensics can also review the analysis performed by other computer forensic companies and check for accuracy and thoroughness.

The final stage of the process is the documentation. Whether you only need the data output from the analysis, or, you need a report for court (or administrative) proceedings, San Diego Computer Forensics can provide it. Our forensic reports and testimony have been fully accepted in federal, state and military proceedings.

Call SDCF at 619.291.SDCF (7323), or fill out the form on this page for more information on our forensic process or for a free consultation.