Data Preservation
Data preservation is probably the most critical element for computer forensic examinations and electronic document productions (e-discovery). Yet, as a vendor, we have the least control over this aspect of the project. It is because of the critical nature of preservation that we make our staff available to execute on-site preservations with short notice. As with all our services, our preservation practice follows accepted computer forensics technique and are repeatable and defensible in court.
We at the Center for Computer Forensics use preservation kits that include write-block devices that protect the evidence, laptops with certified preservation software, and large volume hard drives to receive and transport the data back to CCF’s labs.
All of our examiners are Certified Electronic Evidence Collection Specialists (CEECS) by the International Association of Computer Investigative Specialists (IACIS). IACIS is the same organization that manages the prestigious Certified Forensic Computer Examiner (CFCE) program.
The overriding rule to preservation is not to change one “bit” on the evidence media. Any media can be preserved and prepared for production. Servers are rarely preserved in their entirety. Server data is pulled from the server based on the custodian of interest. The preservation usually includes e-mail files, backup files and mapped drives assigned to the custodian.
Whether you or your client has to produce electronic evidence or you are requesting evidence from the opposing side, the Professional Staff at the Center for Computer Forensics can help you ascertain where the data is and help to ensure proper preservation.