Gordon Pelton explaining the process of digitization Computer Forensics One FREQUENTLY ASKED QUESTIONS COMPUTER FORENSICS COMPUTER SCIENCE EXPERT WITNESSES Providing computer forensics and expert witness services to attorneys, law enforcement, business and individuals. Offices in the San Francisco Bay Area and in the North Lake Tahoe area. Serving San Francisco and the San Francisco Peninsula, San Mateo, San Mateo County, Palo Alto, San Jose, Santa Clara, Santa Clara County, Fremont, Oakland, Alameda County and the East Bay Area, Walnut Creek, Concord, and Contra Costa County, Oakland, Berkeley, Pleasanton, Livermore, and Alameda County, Sacramento, Central California, Northern California, Lake Tahoe, Reno, Nevada and all surrounding communities.   Frequently Asked Questions HOW DO I CONTACT COMPUTER FORENSICS ONE? At the bottom of each page of this website you will find contact information for Computer forensics One. WHY SHOULD I USE A TRAINED COMPUTER FORENSICS SPECIALIST? If the computer is turned on or its contents examined in any way without following exact computer forensics procedures, important evidence could be lost. The evidence could be destroyed or at the very least it could become tainted and either deemed not admissible in court or its credibility called into question by opposing counsel. CAN’T I GET JUST ANY COMPUTER GUY TO SEARCH THE COMPUTER? If your cause results in court or other official proceedings, you will want to be assured that your expert’s procedures, training, capabilities, and experience will stand up to the rigorous challenges of the court and the other side’s attorney. I’VE HEARD THAT DELETED DATA ISN’T REALLY DELETED. Most people think deleting a file on a computer removes the data from the hard drive, floppy or other media. Most people don’t know it’s not easy to erase data from a computer. As a result, there’s usually a lot of evidence that the user doesn’t know has been left there. But you have to know how to find it. That’s what a computer forensics specialist is trained to do. CAN A COMPUTER FORENSICS EXPERT CRACK A SUSPECT’S PASSWORDS? The computer and/or the data is often protected by passwords or encryption. Although it is not always possible to do so, the computer forensics expert has specialized software tools (as well as specialized methods) and is trained to use them to crack passwords and encryption keys. WHAT KIND OF EVIDENCE CAN BE FOUND ON A COMPUTER? In addition to documents prepared on a word processor or data entered into spreadsheets there are often copies of email messages, images (pictures) and even film clips. Sometimes an entire database will be found. Fragments of these types of data often reveal important information – even fragments can be recovered. In addition to this data, we can often determine how a computer was used, what images or documents were viewed and when, which Internet websites were visited, who wrote certain documents and when they were first created and last viewed. We can often even determine when the computer was turned on and when it was last used. HOW CAN DELETED DATA BE FOUND AND RECOVERED? Data on a computer is normally stored in files that are organized into directories (or folders) and subdirectories (folders within other folders). When a file is deleted, its data is not actually erased. All that happens is that the space where the file’s data is stored is marked as “available to be reused.” But, unless another files comes along and usurps the first file’s data space, that data remains there to be found. Often the next files to be stored are stored somewhere else. So the original deleted file, or at least part of it, can be reconstructed. WHERE ELSE IS EVIDENCE FOUND IN A COMPUTER? Evidence is frequently found in printer spools, in system swap files and in system cache files. There are also places where an operating system might store such information as the addresses of recently visited Internet sites or recently opened files. Websites visited sometime store information on a user’s computer concerning visits to its pages. All of this information, if it exists, will be found by a trained and experienced computer forensics specialist. If you have evidence recovery requirements, please contact us. We would like to talk with you about them at no obligation to you.