About Evidence Recovery from Computer Drives for Litigation Support

In both civil and criminal cases, there are going to be those times when you know or have strong reasons to suspect that there is electronic data on a computer hard drive, tape, or other media, that has been hidden, deleted, damaged, or tampered with ~ and you need to get those files or other information. Today, about 1/3 of all available important discovery-related documents can be found on someone's computers. All you have to do is be able to get to those documents.

Our in-house data recovery experts use some proprietary techniques and technologies to evaluate the information on any type of drive or disk - hard drive, CD, DVD, floppy, etc. - without causing any action that would modify that data, the files, or any information such as date or time stamps. Just let us know what you are looking for, and if the information is on the drive, we can find it, so you can get answers to your questions.

The actual process of recovering the "lost" information is similar, whether the cause was a disgruntled employee who deleted the files on his computer before leaving; or persons trying to hide the evidence of fraud, sexual harassment, or embezzlement; or trying to hide the misappropriation of trade secrets, proprietary company processes, customer files, or customer lists, etc.

First Step: If you have a computer that you believe contains any form or files of electronic evidence, discontinue using that machine immediately.

Second Step: When you find that computer, if it was left running, leave it on. If it was already off, leave it turned off. Your attempting to access the computer in any way may change the data contained in the drive, or worse, may activate a set of instructions programmed by the last user to alter, delete, or otherwise tamper with the contents of the drive(s). Continuing to use that computer can also inadvertently overwrite the evidence / data / files, which would make it permanently unavailable.

In many, if not most cases, the "electronic evidence" is still on the hard drive. To recover it requires our skill and experience in Data Recovery and Computer Forensics to identify and retrieve the "lost" data. Our crew of data recovery experts can safely open just about any system, network, or data storage device to recover the files and data. From there, we can determine whether / how it has been tampered with, deleted, or damaged. We can search for any specific data, keywords, phrases, numbers, or files; we can determine when data was accessed; or verify illegal use of proprietary information ~ Depending upon your needs.

The surest way to ensure that all available electronic evidence is secured is to isolate the hard drive, disk device, or magnetic tape involved and secure it in such a way as to satisfy, in court, that the original data was not modified. Ideally, this means we should remove the hard drive(s) from all computers involved. (Hopefully that is not too many of your machines!)

Keep in mind the "chain of custody" and proper documentation and record keeping. If any attempt has been made to delete, erase, or otherwise hide crucial evidence, it is very important that our experienced, data recovery professionals search for, and retrieve the missing information. Be very certain of your data recovery expert! (That's why there's PC Sense...) There are many reasonably good software products on the market, which when used as designed, can recover some lost or hidden data. However, some of these same software products can also permanently lose files or other data that we otherwise could have recovered for you. Do NOT risk your one-and-only chance of recovering critical evidence and information by using standard commercial software. If you have lost data that is this important, dial up your competent PC Sense data recovery professional.

An Inside Peek At How We Help You Preserve Vital Evidence

Before we start to search the drives for the evidence / files you are seeking on a hard drive or tape, we first make a cluster by cluster "clone" or "bit map", the original drive, to one of our own drives. All of the "bits and bytes" of electronic data from the original media are now exactly duplicated, without having changed any of the structure, or the information itself. This process is a very different protocol than simply using the computer's copy command, which can actually eliminate some of the key information that is still on the drive.

Working closely with you as our client, we can use the now-cloned drive to identify any erased or deleted files ~ including the date and the time the file was generated, or the date and time the deletion or the erasure took place.

Using key-word search techniques (this is not the same as using the "find" or other similar commands in most software programs) we can search for words, numbers, or key-phrases, in any or every file.

After that, it's a matter of time, and whatever sifting and sorting needs to be done to identify and isolate the critical from the mundane.

So ~ Put our data recovery expertise to work for you and your clients ~ If the information is available, we can get it out for you. Dial Us Up at  (916) 984-1951  or  (530) 676-4677 Extension 2 ~ OR ~ Click here to drop us an email note, for a Free Consultation. You'll be very glad you did!