Q: What is computer forensics?

A: The collection, preservation, analysis and presentation of computer related evidence. Potential evidence might be sought in a wide range of computer crime or misuse, including but not limited to domestic/family issues, theft of trade secrets, theft of or destruction of intellectual property and fraud. Computer forensic specialist can draw on an array of methods for discovering and analyzing data that resides in a computer system or recovering deleted, encrypted or damaged file information. Any or all of this information may help during all discovery, depositions, or actual litigation. Far more information is retained on a computer than most people realize. It is also more difficult to completely remove information than is generally thought. For these reasons, computer forensics can often find evidence of, or even completely recover lost or deleted items, even if it was intentionally deleted.

Q: What type of evidence can be recovered?

A: Financial records, word processing documents, diaries, spreadsheets, databases, email, pictures, movies, soundfiles, etc...

Q: Where else can evidence be found on a computer?

A: A lot of information is stored on a computer of which most users are unaware. We can usually tell what a computer was used for, when it was used, what and when the user has done on the Internet and recover much of what the user wrote, read or viewed on the computer.

Q: Who can allow a computer to be searched for evidence?

A: The owner of a computer can grant permission for it to be examined. A business may grant permission for a search on any of their computers, regardless of the user.

Q: Where is information stored on a computer?

A: There are many types of storage media. These include floppy discs, hard drives, flash cards, ZIP disks, JAZ disks, Bernoulli cartridges, magnetic tape, magneto-optical cartridges, CD-ROM, CD-R, CD-RW and DVD. The storage may also be on a network.

Q: Who will have access to my computer?

All information exchanged between you and Network Tactics is treated with complete confidentiality and respect. All computer data provided to Network Tactics and any other physical media is locked in a protected area accessible only by our staff. After our work has been completed we hold and store all media and work product until your case has settled. Upon completion of your case, all items you order destroyed are both logically and physically altered beyond restoration.

The computers, networks and systems used by Network Tactics for investigations are not connected to the Internet or any other public network thus we are not a target for hackers, worms and viruses common to the Internet, corporate or other public networks. If the data you provide us has worms, trojans or other software of this type it will not affect any investigation or impair the use of our systems in any way.

Q: How much does your company charge?

Initial telephone consultation is free.

Our rate for forensic analysis and electronic evidence discovery depends on the system to be examined. A forensic examination of a computer usually takes an average of 10-20 hours. The time required to examine a computer may increase or decrease, depending upon the type of operating system, the size of the media, the type of data contained on the media, any password protection, and the amount of data on the media.