The Forensic Process

SDDF expert consultants will discuss your case with you to help determine your needs. Our consultants will then assist you in focusing on the best method of collecting and analyzing the data.

Digital evidence can reside in a variety of devices and locations: desktop and laptop computers, tablets, external hard drives, servers, CDs or DVDs, media cards, USB thumb drives, cell phones, cloud storage and social media sites.

The amount of digital evidence in a case can be staggering. It is important to know what is relevant and where to look for it. We use established court accepted techniques and protocols along with advanced industry standard hardware and software to collect and examine data. SDDF has a digital forensic laboratory that includes a secure evidence storage facility. SDDF can perform on-site collections and are available after hours to ensure your client's business is not disrupted.

The Forensic Process includes acquiring a forensic image. Whether the computer is a stand-alone or a series of network connected systems and servers, we have experience imaging in all scenarios. Forensic images are normally a "bit for bit" or "bit stream" copy of the physical data on a device. Forensic images capture all data areas, including the active file system and the unallocated space (the area where deleted files may reside). Our forensic imaging process uses hardware or software write blocking tools that ensures data is not modified or altered.

The next step in the Process is the analysis. At SDDF, our expert's experience is the key. We know what to look for, where to find it, and how to document the results in the way a judge, jury, or hearing officer will understand.

The final stage of the Process is documentation. SDDF consultants take pride in their ability to document the forensic process in a non-technical way that is understandable by the lay person. SDDF regularly prepares forensic reports and declarations for the court.