Electronic Evidence Retrieval - Computer Forensics - Data Recovery - Expert Witness Testimony

Basic Steps in Data Recovery

Computer Forensics - Data Recovery - Expert Witness Testimony

Taking a perfect image of a computer suspected of containing incriminating data is critical to all ensuing investigative work. Its significance must not be underestimated. When an imperfect image is used to gather suspect data, the resulting evidence will be found inadmissible in court.

Using specialized forensic tools and software, the technician will:

inspect all hard drives, floppy drives, and other available electronic media using methods that will allow the data to be preserved and exhibited in court.
explore and recover deleted files.
explore unallocated space and file slack for data, including hidden data.
explore areas of the media for fragmented data.
explore swap files.
locate and document current and deleted e-mail (sent and received).
extract e-mail and e-mail conversations, identify all e-mail addresses and Web URLs.

In most cases, "hidden," "deleted," or "lost" data cannot be located with the assistance of the limited software tools available to most users. However, sophisticated computer forensic tools allow specialists to find and restore missing data.

EER can provide all of the services listed above and has a proven record for providing the forensic evidence that can make or break court cases.

Feel free to contact us if you would like to know more about computer forensics or if you wish to discuss the role of computer forensics in a current matter.

Electronic Evidence Retrieval, L.L.C.
141 Robert E. Lee Blvd. Ste 108
New Orleans, LA 70124-2534

Gulf Coast: (504) 483-0201
Rockies: (970) 922-7250
Fax: (281) 966-1854

Return to About Forensics Index

Return to EER Home Page