Let’s start with a good definition. Digital forensics is about the investigation and recovery of material found on digital devices. It is the analysis of electronically stored information (ESI) by persons with proper training, tools, and experience. A digital forensics expert is responsible for the acquisition and documentation of evidence, preservation, examination, storage, production of the ESI, and testifying as an independent expert.
Digital evidence is found on computers, servers, e-mail, smartphones, tablets, USB flash drives, external hard drives, and removable media like CDs and DVDs. Digital evidence may include: emails, voicemails, instant messages, text messages, photographs, video, social media, computer search histories, downloads, online documents, spreadsheets, metadata, databases, file fragments, and any other electronic information that is stored on a digital device, even old devices like floppy disks.
There are several sub-branches of digital forensics, including computer forensics, database forensics, mobile device forensics, and network forensics. Though people throw these terms around interchangeably, they are not technically the same.
The process is the most important and critical element of a digital forensics investigation. This is not something your “IT guy” can take care of. You need an experienced and certified expert to accurately preserve and store information so that it is admissible in court. A digital forensics expert’s primary goal is to locate, recover, store, and investigate data, even deleted data and media found on digital devices to reconstruct past events.
The digital forensics process is a 4 step process and includes:
What is the value of a digital forensic expert?
Electronic discovery has become a major part of many, if not most court cases, both civil and criminal. Often electronic evidence can be the determining factor in a case’s outcome. Because of this, you want to have a digital forensic expert witness as part of your legal team and case presentation. This is not an area for do-it-yourselfers. You not only need the appropriate tools and equipment necessary for a thorough examination, you need in-depth knowledge of the process to produce trustworthy results. Effective, expert testimony can mean the difference between winning and losing your case.
What should a digital forensic expert do?
Provide an impartial examination of your case. A digital forensics examiner is an expert witness who draws results and conclusions based on evidence. They are completely impartial and have no preconceived notions about the case, evidence, attorneys, or those on trial.
Use the digital forensic process to acquire electronic evidence. As discussed above, there are very specific ways to collect and preserve electronic evidence. A digital forensic expert will have both the tools and knowledge to maintain the evidence’s integrity to prevent spoliation.
Analyze the evidence and report findings. An experience digital forensic expert will be able to thoroughly review all of the electronic evidence collected and identify and analyze the ESI that is needed for your case. They are adept at presenting the pertinent information in an uncomplicated, easily understood comprehensive report.
Be an effective expert witness. As an expert witness, an experienced digital forensic examiner will be able to discuss, in layman’s terms, how the electronic evidence was gathered and why it should be trusted. It is imperative that a digital forensic expert be both personable and knowledgeable and able to explain the evidence in a way that jurors will understand.
Your legal team should, of course, include qualified, experienced attorneys. But, don’t neglect to include a trained and certified digital forensics expert with professional associations. Your expert should have both legal expertise and technical knowledge. This means you’ll need someone who can do more than just extract data. Your digital forensic expert should also be able to analyze the data collected, provide proof that any ESI has not changed since production, create well-constructed court reports, and act as an expert witness.
Prudential Associates was founded by former Army Intelligence Officer Robert Miller in 1972, who began serving the local legal community as an investigative, surveillance, and intelligence resource.
Prudential Associates has expanded its service footprint geographically and added over 70 extremely valuable staff members and experts; our consulting and service operations have taken place in thousands of locations on nearly every continent. To date we have achieved recognition as the premier resource for clients in sectors such as: television and movie production; maritime services and shipping; large event/concert planning & security; pharmaceutical production; shipping and logistics; human capital management; and, perhaps most notably, in the legal service industry, given our highly distinguished investigative, surveillance, and digital forensics expertise.
Our in-house computer and cell phone forensics lab rivals or exceeds the capabilities of over 90% of the law enforcement labs in the United States, as well as over 99% of those overseas.
For a greater insight into our experience, expertise, and operational history, please see our Corporate Resume.