Gordon Pelton, CCE Certified Computer Forensics Expert
SERVICES
COMPUTER FORENSICS
COMPUTER SCIENCE
EXPERT WITNESS
Providing computer forensics, computer science and expert witness services to attorneys, law enforcement, business and individuals. Offices in the San Francisco Bay Area and in the Northern California and Nevada areas.
Serving San Francisco and the San Francisco Peninsula, San Mateo, San Mateo County, Palo Alto, San Jose, Santa Clara, Santa Clara County, Fremont, Oakland, Alameda County and the East Bay Area, Walnut Creek, Concord, and Contra Costa County, Oakland, Berkeley, Pleasanton, Livermore, and Alameda County, Sacramento, Central California, Northern California, Lake Tahoe, Reno, Nevada and all surrounding communities.
Some of My Services
Computer Science:
I will consult with you concerning your expert requirements and:
Advise you concerning general computer science issues
Review court documents and other case materials
Perform computer science analyses as you require
Work with you to prepare expert reports
Testify at deposition
Testify at Trial
Computer Forensics:
I will examine your floppy disks, hard drives or other media and:
Make Clones of the media
Locate any text you suggest or specify
Recover deleted files or fragments of files
Identify data bases and extract their contents
Extract email messages and headers
Find and copy graphical images
Recover spreadsheets and financial documents
Identify and copy letters or documents
Extract fragments of any of the above
Recover hidden passwords
Provide a list of internet sites recently visited
Disable booby traps
Testify at deposition
Testify at trial
Additionally: I can usually tell you when the computer was last turned on and turned off and who uses the computer. I can often tell you who is the author of certain documents, when they were generated, when they were deleted and when they were last accesed.
The Computer Forensic Examination
I will meet with you either in person or by phone so that we can understand your evidence discovery needs and goals. I will explain how I would conduct your examination and what you could expect from my efforts. After that initial meeting, I will prepare an estimate of the costs required to achieve the goals you have set. When you instruct me to proceed, I will prepare a letter of engagement for your approval and signature. You and I will discuss the tasks you require me to do and and my estimated fee for those tasks.
If your needs involve evidence recovery or similar requirements, I will start by making an exact bit-by-bit copy of all electronic media whether it is one or more hard disks, floppy disks, or other media. I make exact duplicates of the original media so that evidence recovery can be performed on copies and not on the originals. Rigorous chain of custody procedures will be maintained at all times. The procedure used to copy the original media results in exact duplicates and is done in a forensically secure manner onto forensically sterile media. Thus, when the original media are returned to you, you may have the utmost confidence that it has not been altered, that any evidence recovered actually exists on the original media, and that no evidence was missed. As the work proceeds, I will report newly uncovered leads and intermediate findings to you as they occur. As a result of our ongoing exchange of information you may decide that we should eliminate certain of the originally agreed tasks, that we should undertake additional tasks, or that we should modify one or more of the original tasks. If that happens, I will provide estimates of time and cost for the requested changes. If you agree to the changes, I will prepare an addendum to our letter of engagement. The process of review and changes may be repeated as often as you require. It is my intention that both you and I are always clearly in agreement as to the scope of my inquiries and that you are assured that I have addressed every one of your concerns.
During the engagement I will keep records showing what was done on each task, how much time was spent, and what results were obtained.
The Final Report of Examination
When the examination is complete, if you desire, I will document all evidence both in hardcopy and on CD or other electronic media, as you require. The report will include tables, graphics, charts or other materials as required to present all findings clearly and comprehensively. My final report will include explanations and descriptions of the original media, the procedures I followed during the examination, what leads were uncovered, and what evidence was found. Other information deemed pertinent to the examination will be reported. If pertinent, such information could include the following: who uses the computer, addresses of internet sites recently visited, when the computer was last turned on or off, who is the author of certain documents, whether the disk was formatted or defragmented and when, which files had been deleted, and when files were deleted, created, last edited and viewed. Copies of deleted files and file fragments that have been recovered will be provided to you if you require them. If password-protected files are opened, the passwords and unprotected versions of those files will be provided. To the extent practical, the contents of databases and other documents will be presented in table form and may be imported to spreadsheets for your ease of use. I can additionally and/or alternatively present the results to you orally if you desire.
I have been an expert witness in a variety computer cases over the decade and a half. I am available to testify at deposition and at trial.
If you have evidence recovery requirements, please contact me. I would like to talk with you about them at no obligation to you.
Available Upon Request at No Obligation:
C.V. References Complimentary Preliminary Meeting in Your Office and/or Complimentary Preliminary Telephone Conference
