Computer Forensics Services and Expertise 

Computer Forensics is the process by which digital evidence is identified, preserved, analyzed and presented. It involves the use of technology and expertise for investigation and fact recovery when dealing with legal matters. In computer forensics, great emphasis is laid on the integrity and security of the evidence in order that it will be admissible in court. The goals of computer forensics include:

• Recovery of data from target computers with preservation of the integrity of the evidence
• Secure handling of the retrieved/recovered data
• Non-alteration of data
• Identification of significant information
• Adequate presentation of the information in a court of law

In order to successfully achieve these goals, computer forensics experts need to follow a well-defined methodology. ERM’s trusted methodology supported by advanced computer forensics tools ensures that the processing, analysis and reporting of evidence is reliable and objective. Enterprise Risk Management can help you with the following phases of a Computer Forensics investigation:

1. Evidence Collection: Evidence refers to anything that can be collected from the system under investigation by a computer forensics expert. Prior to performing any kind of analysis of sources of digital evidence, it is necessary to uncover all hidden or deleted data. ERM can help with the collection and preservation of evidence while at the same time avoiding unwanted data loss. A “chain of custody” ensures that the integrity of the evidence is not compromised. The methodology that our computer forensic experts use ensures that it is not possible to overwrite the evidence collected.
2. Analysis: This is the phase where the real investigation takes place. The data identified and collected previously will be scrutinized utilizing specialized computer forensic tools and techniques. The focus will be on the creation of a timeline that pieces together the sequence of events and also on the study of internal attributes and format of data in order to gather any kind of information that will help in the investigation. The analysis phase is complex and time consuming but forms the most crucial phase of any investigation.
3. Reporting: Upon completion of the Analysis phase, all findings will be documented and reported in a format that can be understood by all. In most cases, since members of the management will be the recipients of the report, a clear and simple description of the incident, its consequences and recommendations will be provided.

Computer Forensic experts from ERM can also serve as expert witnesses. Expert witnesses possess specialized knowledge that helps find a resolution to legal disputes. As an expert witness, we can testify in a court of law without having been a witness to any occurrence relating to the lawsuit.