San Antonio Computer Doctor
Home | Services | Web Design | Data Recovery | Forensics | Contact | About
Forensics FAQ
Q: What can computer forensics actually recover?
A: Often, forensics are invoked to recover: hidden files; damaged or corrupted files; deleted files; password protected files; encrypted files; email and web correspondence; evidence of web browsing; and internet chat data.

Q: Can deleted files be analyzed forensically?
A: If they have not been completely overwritten, yes. If partly overwritten, maybe. If the file was fragmented before it was deleted, recovery may be even more difficult.

Q: We have IT people in our company.  Why can't they do the forensic investigation?
A: Although they may have a considerable amount of knowledge and experience with computers, it is highly unlikely that they have the required knowledge, training, and experience of the forensic protocols that must be observed to find all of the evidence, protect the data, and ensure the admissibility of evidence in civil or criminal trials. We take steps to safeguard the computer data; these steps require specialized training, hardware, and software. We have the training, experience, and tools to conduct a thorough examination of computer data, and we are able to interpret what we find.

In addition to the lack of skills, hardware, and software, using a company employee can open you up to allegations of fabricating evidence and other impropriety. We are an independent firm, and integrity is the keystone of our company.

Q: In what situations is computer forensics helpful?
A: Computer forensics can be used for employee internet abuse, asset discovery, unauthorized disclosure of corporate information and data (accidental and intentional), industrial espionage, damage assessment (following an incident), criminal fraud, sexual harassment, deception cases, criminal cases (many criminals simply store information on computers, intentionally or unwittingly), and many civil cases.
Copyright © 2012 San Antonio Computer Doctor