Stockton
Computer Forensics Experts

Computer Forensics is the use of specialized techniques for the preservation, identification, extraction, authentication, examination, analysis, interpretation and documentation of digital information. Computer forensics comes into play when a case involves issues relating to the reconstruction of computer system usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer Forensics requires specialized expertise that generally goes beyond normal data collection and preservation techniques available to end-users or system support personnel.

Chain of custody is the record of the custodial history of evidence. The Chain of Custody shows, "WHO had access to WHAT and WHEN did they have it."

Chain of Evidence or authentication is the record of the collection, processing, and analysis of digital evidence. It proves that the presented evidence is unequivocally derived from the acquired digital information.

A forensics image (sometimes called a forensics copy) is an exact bit-by-bit copy of a digital device (hard drive, USB device, cell phone, etc.) including active data, slack space, unallocated space (or unused space). We use court approved forensics tools for making these images. Our tools produce authentication information, called a hash value, to ensure the integrity of the image.

A hash value is a mathematical algorithm produced against digital information (i.e. a file, a physical disk, or a forensics image) thereby creating a digital fingerprint for that information. It is by purpose a one-way algorithm and thus it is not possible to change digital evidence, without changing the corresponding hash values. In other words, if the hash value of a file has not changed, the file itself has not changed.

A hash value, commonly referred to as an MD5, SHA-1, or SHA-256 hash (based on the algorithm used to produce the hash) is used to authenticate digital evidence.

MD5 Hash Example: e6196e1b4f0d1535244eaab534428542

Generally, the concepts overlap, however digital forensics may be the more contemporary expression and more inclusive, recognizing forensics services directed at more types of devices besides those that have been traditionally considered computers, such as cell phones, landline phones, cameras, sound recorders, personal digital assistants, networks including the Internet and others.

The cost of a computer forensics investigation varies greatly, depending on the number and types of systems involved and the complexity of the evidence recovered. Technical Resource Center knows how to ask the right questions to obtain an accurate quote for your investigation.

A complete examination of a single Terabyte hard drive may have over 200,000,000 pages of electronic information and may take between 15 to 100 hours to examine, depending on the amount of data, types of data, condition of the media and data, and the questions to be answered.

A reasonable quote can be obtained prior to the start of the examination if complete and accurate information about the systems is available to the examiner and the scope of the examination is clear (i.e. the questions that need to be answered). This time could increase or decrease, depending upon the type of operating system used, the type of data contained within the system, and the size and amount of data in question.

At Technical Resource Center, our examiner's hourly rate is $500. In most instances, examination and reporting can be completed in less than 20 hours and the complete analysis usually totals less than $10,0000 for a single hard drive.

We charge a $25 hourly rate for equipment operation time (i.e. when our personnel are not actively involved processing evidence, but only periodically monitoring the processing).

Certifications:
CCE - Certified Computer Examiner - International Society of Forensic Computer Examiners (ISFCE)
CISSP - Certified Information Systems Security Professional - International Information System Security Certification Consortium (ISC)²
CFE - Certified Fraud Examiner - Association of Certified Fraud Examiners (ACFE)
CHFI - Computer Hacking Forensic Investigator - EC Council
CEH - Certified Ethical Hacker - EC Council
EnCE - EnCase Certified Examiner - Guidance Software
ACE - AccessData Certified Examiner - AccessData Group
Certified ProDiscover Examiner Instructor - Technology Pathways
Certified XRY Physical Mobile Phone Examiner - MSAB

Licenses:
Licensed California Private Investigator #28170
Licensed Florida Private Investigation Agency #A1700255
Licensed Georgia Private Detective Agency #PDC002261
Licensed Michigan Professional Investigator Agency #3701207406
Licensed South Carolina Private Investigations Business #3955
Licensed Texas Private Investigation Company #A06230801
Licensed Utah Private Investigation Agency #P112091