Hard Drive Exposed Computer Forensics One OUR SERVICES COMPUTER FORENSICS COMPUTER SCIENCE EXPERT WITNESSES Providing computer forensics, computer science and expert witness services to attorneys, law enforcement, business and individuals. Offices in the San Francisco Bay Area and in the North Lake Tahoe area. Serving San Francisco and the San Francisco Peninsula, San Mateo, San Mateo County, Palo Alto, San Jose, Santa Clara, Santa Clara County, Fremont, Oakland, Alameda County and the East Bay Area, Walnut Creek, Concord, and Contra Costa County, Oakland, Berkeley, Pleasanton, Livermore, and Alameda County, Sacramento, Central California, Northern California, Lake Tahoe, Reno, Nevada and all surrounding communities.   Some of Our Services Computer Science: We will consult with you concerning your expert requirements and: Advise you concerning general computer science issues Review court documents and other case materials Perform computer science analyses as you require Work with you to prepare expert reports Testify at deposition Testify at Trial Computer Forensics: We will examine your floppy disks, hard drives or other media and: Make Clones of the media Locate any text you suggest or specify Recover deleted files or fragments of files Identify data bases and extract their contents Extract email messages and headers Find and copy graphical images Recover spreadsheets and financial documents Identify and copy letters or documents Extract fragments of any of the above Recover hidden passwords Provide a list of internet sites recently visited Disable booby traps Testify at deposition Testify at trial Additionally: We can usually tell you when the computer was last turned on and turned off and who uses the computer. We can often tell you who is the author of certain documents, when they were generated, when they were deleted and when they were last accesed. The Computer Forensic Examination We will meet with you either in person or by phone so that we can understand your evidence discovery needs and goals. We will explain how we would conduct your examination and what you could expect from our efforts. After that initial meeting, together we can select the person or persons from our staff who will work with you on your case. We will also prepare an estimate of the costs required to achieve the goals you have set. When you instruct us to proceed, we will prepare a letter of engagement detailing the staff member(s) and tasks we have agreed upon, the expected hours and our fee for those tasks. If your needs involve evidence recovery or similar requirements, we will start by making an exact bit-by-bit copy of all electronic media whether it is one or more hard disks, floppy disks, or other media. We will make exact duplicates of the original media so that evidence recovery can be performed on copies and not on the originals. Rigorous chain of custody procedures will be maintained at all times. The procedure used to copy the original media results in exact duplicates and is done in a forensically secure manner onto forensically sterile media. Thus, when the original media are returned to you, you may have the utmost confidence that it has not been altered, that any evidence recovered actually exists on the original media, and that no evidence was missed. As the work proceeds, we will report newly uncovered leads and intermediate findings to you as they occur. As a result of our ongoing exchange of information you may decide that we should eliminate certain of the originally agreed tasks, that we should undertake additional tasks, or that we should modify one or more of the original tasks. If that happens, we will provide estimates of time and cost for the requested changes. If you agree to the changes, we will prepare an addendum to our letter of engagement. The process of review and changes may be repeated as often as you require. It is our intention that both you and Computer Forensics One are always clearly in agreement as to the scope of our inquiries and that you are assured that we have addressed every one of your concerns.  During the engagement we will keep records showing what was done on each task, how much time was spent, and what results were obtained.   The Final Report of Examination When the examination is complete we will document all evidence both in hardcopy and on CD or other electronic media, as you require. The report will include tables, graphics, charts or other materials as required to present all findings clearly and comprehensively. Our final report will include explanations and descriptions of the original media, the procedures followed during the examination, what leads were uncovered, and what evidence was found. Other information deemed pertinent to the examination will be reported. If pertinent, such information could include the following: who uses the computer, addresses of internet sites recently visited, when the computer was last turned on or off, who is the author of certain documents, whether the disk was formatted or defragmented and when, which files had been deleted, and when files were deleted, created, last edited and viewed.  Copies of deleted files and file fragments that have been recovered will be provided to you. If password-protected files are opened, the passwords and unprotected versions of those files will be provided. To the extent practical, the contents of databases and other documents will be presented in table form and may be imported to spreadsheets for your ease of use. We can additionally present the results to you orally if you desire.   Our Principal Consultant has been an expert witness in a variety computer cases over the past fourteen years. Any of our staff is available to testify at deposition and at trial. If you have evidence recovery requirements, please contact us. We would like to talk with you about them at no obligation to you.