×

Digital Forensics Services

Digital ForensicsAt Envista Forensics, our certified and seasoned experts have worked on thousands of matters involving digital evidence. In every case, our objective is to provide actionable and accurate results to our clients, often under strict guidelines and tight time frames. Our team is dedicated to working closely with our clients through effective communication and planning to help you reach the best possible outcome in your case.

Our digital forensics experts have specialized expertise that allows them to assist their clients with the collection, examination, preservation, and presentation of digital evidence.

At the core of digital forensics is advanced data recovery capabilities, which include data that has been deleted, encrypted, or damaged. At every stage of the process, our digital forensic experts utilize technology and methodologies that prevent the evidence from being changed, altered, or corrupted. Digital forensic examiners treat every case as if it will go to court, understanding that the evidence and their analysis must be above reproach.

True End-to-End Consulting

Our experts can assist you in the technical portions when developing motions and orders to access evidence. In many instances, if the evidence is not asked for correctly with the proper technical terminology, it will result in receiving the wrong information or nothing at all.

Our experts will be able to assist you in determining where valuable data is to your case. This includes if the data is on local devices such as mobile phones and computers, network share drives, cloud storage, or social media accounts.

Before analysis, a protocol needs to be in place before work can even begin in many instances. Our experts can assist you in creating a protocol for examining evidence. This protocol will provide the necessary information to ensure all of the parties involved that the original evidence items will remain exactly as they were before the examination. Every attempt will be made in a digital forensics analysis to preserve digital evidence as a "snapshot in time" of exactly how they existed upon seizure or forensic imaging (copying).

Our experts can verify the work of an opposing expert to determine if the findings are valid. This process involves performing an independent analysis of the evidence to ensure the facts are accurate and that all evidence has been thoroughly analyzed. It is not uncommon for some experts to find their alleged "smoking gun" and then proceed to end their examination prematurely as they have not taken all of the data into account.

Our experts treat every case like it is going to trial. They can assist you in understanding what an opposing expert is going to say based upon their forensic report. Further, our experts can assist you in writing a direct examination for themselves and preparing a cross-examination for an opposing expert.

The Digital Forensics Analysis Process

There is a chain of events that occurs as part of a forensic examination. These events include:

Consultation

During a thorough consultation, a digital forensics expert will work with counsel and the information technology team at an organization to ascertain the location of relevant data and explain the various methods by which this data can be collected.

Acquisition

During the acquisition phase, digital forensics experts utilize forensic tools and methodologies to collect data from various electronic sources.

These methods include on-site collections, where our experts go on location to make forensic images or copies of computers, servers, cell phones, cloud data, and/or social media.

Analysis

Our experts examine the data using specialized forensic technology and methods, including the recovery of deleted data. In our in-depth analysis process, we seek to determine what occurred, how it occurred, and who the responsible parties could be.

In the analysis phase, we aim to answer questions such as:

  • Did the employee engage in bad faith, providing sensitive information to outside parties?
  • Was a documented altered, forged, or otherwise manipulated electronically?
  • What actions did a user perform on specific dates and time frames?
  • Did the user attempt to delete electronic data?
  • Did the user use anti-forensic tools to try and cover their tracks?
  • Was company policy broken concerning acceptable computer usage?
  • Did an employee steal customer lists on the way out the door?
  • Did the driver's distraction cause the car accident because they were texting while driving?

Reporting

If requested by the client, the reporting phase begins. This phase is where the technical roadmap is laid out of what happened in a case. For example, if there were concerns that a former employee stole intellectual property, this report would include the explanation and analysis of forensic artifacts that point toward evidence of user attribution. In other words, what files were accessed, how these files were exfiltrated from the organization, who took the data when the data was stolen, and how it is potentially being used.

Expert Testimony

To provide expert testimony in court, that expert needs to be able to qualify first. If the expert's qualifications are challenged, the attorney calling the expert must show that the expert has the necessary background experience. This includes questions related to the expert's education, certifications, case experience, training, and special knowledge. Further, to be effective, an expert needs to explain complex technical issues in plain language. Our experts are skilled at translating technology into an accessible way to triers of fact in a case.

Need a Digital Forensics Consultant?

Please visit our expert directory.

Case Study
ransomware alert
Post-Ransomware Cost Review
After a mid-sized manufacturing company encountered a ransomware attack that encrypted production data, Envista's Data Loss Consulting team was brought in to confirm the attack and determine the cost to remediate the damage.
ransomware alert
Read The Latest Articles
How Can We Help You?

We have experts in multiple disciplines all around the world. Talk to us and we'll help you find the right expert for the job.

 Envista Forensics Logo
Explore Our Site

Our job is to solve complex problems for our clients, in the face of a disaster. We serve business owners, small and large, no matter where they are in the world, and no matter what problem they are facing.