Ask the Experts: What is Digital Forensics?

A question we are commonly asked is, “What is digital forensics, exactly?” For a literal definition, we can turn to Techopedia:

“Digital forensics is the process of uncovering and interpreting electronic data. The goal of the process is to preserve any evidence in its most original form while performing a structured investigation by collecting, identifying and validating the digital information for the purpose of reconstructing past events.”

While this is a comprehensive explanation, it doesn’t get at the heart of what people are asking: namely, what does digital forensics entail? The answer to that question is much more involved.

What is Digital Forensics?

Digital forensics examinations can take many forms:

1. Hard drive recovery – Digital forensics examiners are experts at uncovering electronic data, even – or especially – when that data appears to be lost. Our Philadelphia computer forensics team are well-versed in hard drive recovery and “missing” data. The most common types of data that are recovered include:
   • Automatically stored data – Many computer programs automatically backup files in alternate directories. If the original file is lost or destroyed, a backup file may still exist.
   • Deleted files – Deleting a file simply tells the computer the physical space the file occupied is now available. The data itself remains until it is overwritten.
   • Residual (“ghost”) data – This data, which includes deleted files, file fragments, file slack, and unallocated space, does not appear to be accessible through file or directory commands.
2. Employee misconduct investigations – Intellectual property (IP) theft is a growing problem for businesses. Departing employees are the most common culprits, taking trade secrets and customer databases and going to work for the competition. Another problem is the growing trend of BYOD – Bring Your Own Device. The use of personal devices in the workplace makes it harder to track compromised and stolen data, as well as complicating the investigation process. Precise can help you navigate the turbulent waters of employee digital forensic investigations.
3. Mobile device examinations – Cell phones, Apple watches, GPS units, and tablets or just of the mobile devices that can provide critical information to a case. These devices require specialized tools and training in order to access and preserve their data.

Precise: the Digital Forensics Experts

For outstanding computer forensics, Pittsburgh turns to Precise. Our team of expert investigators can pull and preserve data from a variety of devices. We will ensure you don’t lose evidence due to spoliation, and even provide expert witness testimony in the courtroom. For more information on our digital forensic services, call us today at 866-277-3247.