The In’s and Out’s of Digital Forensics and Why it’s Important for your Firm

In today’s day and age, most legal cases have some type of involvement with digital media. With the proper tools and insight into digital forensics, it can positively impact your case and bring your trial into fruition.  Let us break down the ins and outs of digital forensics and why it’s important to your firm.

Digital Forensics Explained:

Digital forensics is the discovery and investigation of documents or data found in electronic devices, such as computers, tablets, and cell phones, which have been involved in criminal activity. Any device that contains any type of memory storage, it is subject to investigation. Other examples of devices subject to investigation would be GPS, storage devices, CD’s, DVD’s, and anything containing a memory card, such as a camera or smart phones.

Forensic Imaging is the first step taken when performing an investigation. A forensic image is a read only copy of whatever device you’re examining. This read only copy will include not only all of the documents and stored data on the device, but all of the open space as well. Forensic imaging can be done with a hard drive copying device.

Once the imaging is complete, you now have your “forensic copy.” This copy is an exact replica of the information you need, completely unaltered. Unfortunately, you cannot retrieve deleted files when creating a forensic copy, but you can retrieve them in imaging. It’s very likely that your device will contain some type of deleted files.  You can determine a list of what has been deleted through examination, and more often than not you can recover those files. The only issue in dealing with deleted files is that once those files have been deleted by the user, that space is now considered blank, and can be overwritten. If that storage space has not been used since, those files can be recovered. If that space has in fact been overwritten, those files are no longer accessible.

Interestingly, a forensics investigation can also conclude if any other external devices have been connected to another device that is being examined. More often than not, any external device that is plugged into another device will leave a trail, leaving identification behind.

Digging deeper, forensic investigation will also uncover metadata. Metadata is more in-depth information about your storage. This type of information would uncover authors of documents, printing dates and times, time stamps on photos, and if you’re using mobile device, it’ll reveal the exact location of where the data was created.

Digital Forensic investigations are extremely important in today’s world. Hiring a digital forensic investigator can be costly and time consuming, but it’s worth the investment. Investigators can cost anywhere from $190 an hour to $365 an hour.