Computer Forensics

Computer forensics is the use of specialized techniques for recovery, authentication and analysis of electronic data when a case involves issues relating to reconstruction of computer usage, examination of residual data, and authentication of data by technical analysis or explanation of technical features of data and computer usage.

Forensic computer examinations are tightly controlled and fully documented examinations of computers and associated storage media for data. This data could provide potentially relevant evidence and/or investigative leads.

Forensic computer examinations go far beyond normal data recovery techniques and go into areas and files on the media not normally accessed by untrained personnel. These examinations can find the data that the agency or client wants or needs.

Forensic computer examinations are conducted using procedures and protocols that ensure all data that can be found is recovered and presented to the client. A forensic computer examination will ensure that the data found is admissible in court, if necessary.


In any type of litigation or case, where a computer was either used to keep business or personal records or documents, the potential that useful evidence is contained on the computer and that the case can be resolved more quickly is very high.

Sensitive data is frequently password protected or deleted when the potential or actual litigation becomes known. The password protected data can be accessed, the deleted data may be recoverable, and previous drafts or other copies of the sensitive data may be recoverable.

Frequently recovering deleted or formatted data and showing which particular files were deleted or removed is a good indication of culpability or a valuable insight into what the person was trying to do at the time of the deletions.

Determining dates and times of deletion or formatting frequently coincides with actions taken by employers and law enforcement, i.e. the employee formats his Hard Disk Drive one hour after being accused of selling or using company sensitive data.

There are hidden areas, such as cache, swap and temporary files on the computer that may contain sensitive data. There is a very high possibility that this data can be recovered and will be important to your litigation or case.


We can assist you in any of your claim investigations or in-house investigations that involve computers or the possibility that data or other evidence is contained on computers.

Frequently computer evidence quickly resolves or facilitates claim resolution or litigation. Some examples of investigations we can provide include:

  • In-house financial or fraud investigations.
  • Arson and the related insurance fraud investigations.
  • Any investigation where there may be evidence, whether hidden, not accessible, or password protected, that is located on computer media.
  • Wrongful death, workman's compensation cases where there may be evidence located on a computer or other media.


We can assist your company or corporation in a number of areas. From information contained on the hard disk drive at a networked or desk computer, it is frequently possible to determine if an employee has been accessing, tampering with or copying sensitive or other files.

  • Internal fraud or financial abuse or similar crimes.
  • Unlocking/recovering files where the password is not known or the file has been deleted or destroyed.
  • Disgruntled or terminated employees frequently delete, hide, password protect or otherwise try to destroy files when they leave. Frequently employees who have defrauded the company or are trying to hide something, delete or password protect files that may expose their activities.
  • Accidentally deleting files is a common occurrence. We can quickly recover deleted files if they have not been overwritten or have been backed up by the application you are using. Once a file has been accidentally, or otherwise deleted or removed, stop using the computer and contact us. We can unlock or recover files at reasonable rates.

Private Investigator

  • 75% of men and 65% of women admit to having an affair with people they work with.
  • 70% of wives do not know about their husband's affair.
  • 54% of husbands do not know about their wife's affair.
  • 38% of people have engaged in explicit online sexual conversations.

Forensic computer examinations can often reveal these activities by examining such things as internet history, pictures, chat logs and emails on a spouse's computer.

We can assist in cases that involve missing or exploited children. If these children used computers or accessed the internet, there are many hidden locations where files are created by the browser or other applications. Often these files can be accessed and will show which files, locations, chat rooms, etc. were recently accessed or downloaded. A recent history of internet activity is normally maintained by the browser.