Computer Forensics – What is Digital Forensics?

Think of all the devices we interact with or encounter each day. All of those electronic devices and systems house data. Digital forensics is a specialized field focused on the investigation, collection, preservation, and recovery of that data in order to answer questions or recreate a series of events.

What is Computer Forensics?

What digital forensics artifacts can you find on a mobile phone?

As of 2016, there were 395.9 million wireless subscriber connections of smartphones, feature phones, and tablets in the United States, roughly 120% of the population. Mobile forensics is the service through which examiners extract and evaluate the data stored within a mobile device. Modern smartphones contain a plethora of information that could potentially be of evidentiary value including:

• User dictionary content
• Phone book or contact lists
• Data from various installed apps
• Incoming, outgoing, missed call history
• System files, usage logs, error messages
• To-do lists, notes, calendar entries, ringtones
• Passwords, passcodes, swipe codes, user account credentials
• SMS text, application-based, and multimedia messaging content
• Pictures, videos, audio files, and sometimes voicemail messages
• Hard Drive, Solid State Drive, SD Card, USB Flash Drive Forensics
• Documents, spreadsheets, presentation files and other user-created data
• Internet browsing history, content, cookies, search history, analytics information
• Historical geolocation data, cell phone location data, Wi-Fi connection information

Deleted data from all of the above

The most common devices we see in our data recovery lab are hard drives, SSDs, USB flash drives, and everything in between. Regardless of the device’s condition, our expert investigators and data recovery experts can dive in and find the information you’re looking for.

Hard Drive Forensics

The data stored within each hard drive tells a story. We examine the data carefully and piece together the story as accurately as possible. The files on a hard drive and the metadata defining them can reveal how and when the hard drive was used. When were files created on the drive, and when were they modified? Who was using the hard drive? Which devices (such as mobile phones or USB flash drives) were connected to the computer when it was in use? Our skilled and knowledgeable forensic investigators can uncover the answers to these questions.

Most hard drives we encounter are perfectly healthy. But, we occasionally work on hard drives that were intentionally destroyed, deleted, or reformatted. To avoid unintentional data spoilage, we recommend consulting with our experts. When we encounter data spoilage, telling the story of a hard drive’s use becomes much more difficult, requiring the aid of our experienced data recovery professionals to salvage missing data.

Solid State Drive Forensics

Unlike a hard drive’s rapidly spinning platters with magnetic substrate to store data, SSDs don’t have any moving parts. Instead, they rely on electrons for data storage. Our technicians have years of experience working with solid state drives and are familiar with the many issues that arise when working on them given their different technology and construction. We take every precaution to ensure that any preventable issues don’t occur when working on a case.

Broken Hard Disk Drives

Hard disk drives have dominated data storage for decades, and while solid state drives are steadily encroaching on their territory, they are still the primary—and often secondary—form of data storage in the vast majority of computers today. Users typically store the vast majority of their data on the internal hard drive inside their computer, with many also hooking up portable external hard drives via USB cable for extra storage capacity.

Hard drives have very sensitive moving parts inside them. All of the data contained on a hard drive live within its hard disk platters, which store binary information in the form of magnetic charges on a thin coating of magnetic substrate over aluminum or glass. A brushless spindle motor spins the platters at thousands of revolutions per minute. Read/write heads, like the needle of a record player, transmit data to and from the platters by hovering several nanometers over their surfaces. These moving parts make for a lot of failure points, making hard drives especially vulnerable to damage from physical shock… or just old age.

You’re accustomed to seeing hard disk drives that function more or less perfectly. What do you do when you encounter one that doesn’t?
When a hard disk drive breaks down, it takes special tools and expertise to salvage the data from it for further forensic analysis. Finding people with access to these skills and techniques and sufficient know-how in the field of digital forensics as well might sound like a tall order. But this combination of specialists is exactly what BIG computer specialists has to offer.

Using the same principles pioneered in other forensic sciences, our digital forensics examiners analyze digital artifacts (pictures, documents, emails, web browser history, etc.) stored within a desktop or laptop computer. These digital artifacts can have a profound impact on the outcome of criminal and civil litigation, either on their own, or when coupled with other pieces of evidence gathered during an investigation.

• Emails
• Financial Documents
• Desktop Surveillance
• Password Protected Files
• File / Document Recovery
• Business / Employee Misconduct
• Social Media
• Pornography
• Chat Pictures
• Internet History
• Dating Site Activity

Forensic Services

Computer forensics services are commonly employed by law enforcement and legal professionals hoping to gain a deeper understanding of the activities, psychology, and motivations of an individual by analyzing the data stored on a computer(s).

Our clients turn to us to help them understand the value of electronic information and how it can be used to their advantage. We help them ask the right kind of questions, so they may receive the relevant information they need to build an effective case.

Emails, documents and deleted information may be stored in unexpected locations, and our computer forensics examiners have the experience to find these caches. Data may be contained in file servers, mail servers, workstations, cell phones, tablets, CD-ROMs, USB devices, backup tapes and archiving systems. Blackstone Computer Forensics team provides you with the expertise needed when it comes to Digital Evidence. We can help you with cases involving:

• Fraud
• Divorce
• Acquisitions
• Human Resources
• Intellectual property
• Internal investigations
• Social media (Facebook, Twitter, etc.)

With the use of technology, some degree of risk – often significant – is unavoidable.

The possibility exists that unauthorized users could access sensitive information through public access points and utilize that information in an inappropriate manner. The result of this activity could result in additional risk to organizations, including state and federal violations and a damaged reputation. Every network is vulnerable to some form of attack. However it is not enough to simply confirm that a technical vulnerability exists and implement countermeasures; it is critical to repeatedly verify that the countermeasures are in place and working properly throughout the secured network.

If you have a Computer Forensics or Data Recovery case you would like to discuss, contact Blackstone Investigations Group, LLC today. Our teams of highly experienced forensic investigators have the skill and the resources to recover the information and data you are looking for in a timely, confidential manner. CALL US TODAY so we can retrieve the information you thought was gone forever!