Why is digital forensics important?

Digital forensics is incredibly important for legal proceedings as it can help provide clear and compelling evidence to help prove or disprove a case.

Digital forensics can uncover electronic evidence such as emails, texts, photos, and more that can be used to aid in litigation.

Additionally, it can help recover deleted data that might not be available from other sources.

By analyzing digital evidence, digital forensics can provide an accurate timeline of events leading up to or during a case, and help establish the credibility of witnesses or documents by verifying their origin or source.

In summary, digital forensics is an invaluable tool for litigation and can provide an invaluable source of information to help build a solid case.

Five Stages of A Digital Forensic INVESTIGATION

When you retain Hiltz & Associates to conduct a “digital forensic examination”, we generally follow these five steps.

Assess

Before any data is collected, Hiltz & Associates will assess your situation to determine the data that is most critical to your case. Our approach to devise a plan to get the information needed at the lowest collection cost.

Collect

In most cases, before conducting an examination, Hiltz & Associates will create a forensic copy* of the source to safeguard its integrity.

* a forensic copy (also called a “bit-by-bit” copy) is an exact and complete reproduction of the original media, encompassing all visible data accessible through the file system, alongside any concealed data residing in unallocated space.

Depending on the case, we may also obtain data from other third parties for examination. (Google, Microsoft, your cloud host, mobile network, ISP, and more)

Examine

The objective this stage is to segment (parse) the data to identify relevant information for analysis. This process typically involves,

• recovering deleted information
• indexing mailboxes, computer backups, and compressed archives
• retrieve artifacts such as web browser history
• extracting metadata
• identifying the history of opened files and connected storage devices
• culling unnecessary files (duplicate and system/application files)

Analyze

Hiltz & Associates will analyze the data collected using powerful forensic tools to find specific types of data.

Searches are typically conducted using keywords, IP addresses, email addresses, file types, date ranges, and other fields.

This allows us to correlate digital evidence with timelines to support or refute the provenance of evidence and witness accounts.

If you are like most people, you may think that the goal of digital forensics is to uncover a digital “smoking gun”.

Sometimes we do find the “smoking gun”, but more often the goal is to establish a sound narrative around various pieces of digital evidence that helps win cases. As an example, read about the case below.

Report

Depending on your case, Hiltz & Associates can prepare an expert report.

In certain situations, an expert report is not desired since it is discoverable by the opposing side. In such cases, we report and discuss our work product findings directly with your attorney.

If an expert report is desired, it will describe each of the phases (activities) undertaken during the investigation and include exhibits and demonstratives, supplemented with our opinions and conclusions.