The gathering of digital evidence takes specialized tools and personnel trained in specific techniques to conduct a through analysis of digital media...

As computers have become more prevalent in the business world, employers must safeguard critical business information. An unfortunate concern today is the possibility that data could be damaged, destroyed or misappropriated by a discontented individual. Computers and other digital devices can also contain evidence in many types of situations, including the theft of proprietary trade secrets, sexual harassment suits, allegations of discrimination, wrongful termination claims, employee theft and fraud. Digital evidence can be found in electronic mail systems, on network servers and on individual employee's workstations. However, due to the ease with which computer data can be manipulated, if the search and analysis is not performed by a trained Computer Forensic Specialist, the evidence gathered could likely be dismissed during an administrative or judicial proceeding.

Investigative Protocols:

Diogenes LLC computer forensic specialists take steps to identify and attempt to retrieve all possible evidence that may exist on digital media, whether it is a floppy disk, smart card, a computer system or network attached storage. Some of the procedures our examiners follow according to U.S. Department of Justice guidelines are: 

• Protect the computer system during the forensic examination against alteration, damage, data corruption, or virus introduction.

• Find and record all files on the system. This includes currently active files, deleted yet remaining files, hidden files, password-protected files, and encrypted files.

• Recover deleted files.

• Reveal the contents of hidden files as well as temporary or swap files used by both the application programs and the operating system.

• Analyze all potentially relevant data found in special areas of a disk. This includes what is called 'unallocated' space on a disk as well as 'slack' space in a file (partial data from older files still residing in space on a hard drive that has been allocated to newer files but not used up by it).

• Access the contents of password protected or encrypted files.

• Report an overall analysis of the system, as well as a listing of all possibly relevant files and discovered file data. Provide an opinion of the system layout, the file structures discovered, any discovered data and authorship information, any attempts to hide, delete, protect, encrypt information, and anything else that has been discovered and appears to be relevant to the overall digital examination.

"Diogenes LLC follows comprehensive procedures as developed by the U.S. Department of Justice to establish and maintain a continuing chain of custody for the handling of digital media. Our procedures are designed to minimize the risk of damaging, destroying or otherwise compromising the evidence during the investigation of the targeted computer's data storage areas. Diogenes LLC investigators use a varity of tools including EnCase and FastBloc. EnCase is validated by the courts and allows Diogenes investigators to conduct a powerful, yet completely non-invasive computer forensic investigation. EnCase views all relevant files, including "deleted" files, file slack and unallocated space. FastBloc is the most advanced hardware write-blocking tool available and protects the original evidence."