IT Forensic Technologies, Inc.

Computer Forensic & IT Specialists

FAQs

How is a Computer Forensics examination performed?
What can a Computer Forensic examination provide?
What types of media can be examined and does it include cell phones?
What are common situations in which Computer Forensics is used?
Can I ship you my hard drives?

Why do attorneys need to consider computer forensics for their clients?
How much does a computer forensic investigation cost?
What form of payment is accepted?

How is a Computer Forensics examination performed?

The first step after determining the client’s needs is securing the hard drive/media on the device in question.  The examiner will then make a bit-by-bit image copy of the device.  The original device is either returned to the owner or kept in a secure place determined by the courts.  The copying of the device usually takes 5- 6 hours.  It takes the examiner less than an hour to set up the device to be copied and everything else is automated.

The copy of the device is then examined using a forensic software program called EnCase Forensic (www.guidancesoftware.com).  Dependent on the hard drive size this examination can take anywhere from 10- 50 hours.  During this examination all files on the computer are examined and evidence for the specific purpose are also attempted to be found.

After the examination the report will include relevant documents, images, internet history, temporary files, deleted file and anything that will assist with the investigation.  This report will be provided on a CD for the client and multiple copies can be made with the results of the investigation.  You will also get the credentials of the examiner along with their Encase Certification Number.  This allows the examiner to be credited by the courts and testify in court if needed.
Top

What can a Computer Forensic examination provide?

·    Data Recovery of deleted computer files, including hidden files even after a hard drive has been reformatted or repartitioned
·    Passwords for password protected or encrypted files
·    Determination of: Web sites that have been visited, Files that have been uploaded or downloaded, When files (docs, pictures, etc) were last accessed/deleted.
·    Discovery of: Attempts to conceal, destroy, or fabricate evidence, Text that was removed from a document's final version, Faxes sent or received on a computer, Email, texts webmail and attachments, even if deleted, Other types of communications strings (IM chat logs).
Top

What types of media can be examined and does it include cell phones?

Evidence can be extracted from desktop hard drives, personal computers ( laptops), PDA's, cell phones, Tapes, DVD's, CD's, digital cameras, and other electronic devices
Top

What are common situations in which Computer Forensics is used?

·    General criminal cases
·   
Civil cases (divorces, adultery)
·   
Employee Internet abuse or other violations of computer policy
·   
Negligence, sexual harassment, and deception cases
·   
Evidence collection for future employee termination
·   
White-collar crime
Top

Can I ship you my hard drives?

Absolutely, but before you do anything to the computer please call for a consultation.  We need to make sure that an IT professional is available to properly take the hard drive out of the computer.  We will provide you detailed shipping instructions along with the timeframe of returning your original hard drive(s) to minimize downtime.  Please ship the hard drive in an anti-static bag(no Styrofoam) and make sure that the drive does not bounce around in the box during the shipping.  We also recommend insuring the hard drive(s) and provide tracking numbers.
Top

Why do attorneys need to consider computer forensics for their clients?

In many high profile cases digital or computer evidence has been the “smoking gun” in these types of cases.  Everything today is stored by electronic means by one way or another.  It certainly is not in any client's best interest to ignore potentially relevant sources of evidence, including computer evidence.
Top

How much does a computer forensic investigation cost?

The total cost of an investigation varies by the number of hard drives and other media devices.  The average cost per hour from a reputable computer forencis company is $225- $350/ hr.  The following are the list of charges:

A retainer rate of $1000 is required prior to any service
Hourly Rate: $225/hr
*Economic Special: $750
Daily 8 hour rate: $1600 (Save $200 off hourly rate)
Courtroom testimony: $200/hr

**Estimation of hours/cost for one hard drive:
Setting the drive up and acquiring a copy: 1 hour
Hard drive examination: 10- 15 hours
Report writing: 1 hour
Total estimated work: 12-17 hours
Total Cost: $2700- $3825

*Economic special includes hard drive image acquisition and three hours of forensic service.  During this three hours the drive is examined as a whole to see if the drive contains files/images that the investigation is seeking.  A list of files are then presented to the client and the client is asked if they would like a more thorough investigation and is presented with an hours of estimation work order for the rest of the exam.

**This estimate is based on a typical hard drive.  This cost estimate can vary based on the size of the hard drive, number of hard drives and the work required to analyze the drive.  A consultation will need to be required for an accurate estimate on the total cost of the investigation.  We provide upfront prices to our client and will have no hidden fees.  We have no lab fees that other companies may try to charge

Top

What form of payment is accepted?

All major credit cards are excepted.  We also except cash.  A receipt will be provided for all transactions.
Top

Call or email today for a free consulation:
563-449-4062
or Email



EnCase Certified Examiner Logo

InfraGard Member Logo