Digital forensics is one of the fastest growing fields in the digital world. At one time computers were an afterthought when it came to criminal investigations. However we are now in the digital age. People’s cell phones, tablets, TV’s, and yes their computers are all an integral part of life. And in a criminal investigation, they are often the key to proving where someone was or wasn’t when a crime happens. However, when it comes to gathering and analyzing this digital evidence, it’s very easy to get the evidence disqualified and thrown out of court.
One specific time when this is a real challenge is when data recovery is required. In a perfect world, digital media would always be fully functional and you could get a 100% clone of it with full HASH to prove that the evidence wasn’t tampered with. However what happens when the media isn’t functioning at all? Or is partially destroyed…
Forensic Data Recovery
Greg and Sheila have partnered up with a company in Cranston, RI called Data Medics (their website is here). This company is able to handle just about any type of failed media at affordable prices. Most investigations still assume on the prices of ten years ago when data recovery always cost thousands of dollars. However nowadays there are qualified professionals who’ve broken out of the extreme pricing game and offer their services at reasonable rates. Usually just $300-800 for most typical hard drive failure cases. By using such affordable quality service, we’re able to markup the price and turn a profit on that part of the investigation.
Whatever data recovery firm you decide to use for handling the hardware recovery end, be sure they have the capabilities to provide a forensic image which can work in Encase or other software. Hardware tools such as PC-3000, used by most professional labs, should be able to generate these forensically sound images which meet with courtroom standards for evidence. Remember that a partially cloned image directly onto another hard drive will have a different hash, and may be thrown out of court even if the data wasn’t altered in any way and the destination drive was originally blank. A sector that is all zeros because it wasn’t read from the source is still data as far as the law is concerned. So be smart and request the forensic image files, which will check out.