ESI Preservation & Collection

Forensicon has assisted clients of all sizes with ESI preservation & collection in response to the needs of litigation holds and governmental or legal discovery requests. Forensicon technical staff is trained in the best practices for collection of electronic evidence and are capable of collecting data on a forensic best practices basis, or using more cost effective logical file collection technologies. As part of collecting data, Forensicon deploys a suite of leading technologies including Guidance Software’s EnCase Software, Access Data’s FTK Imager, Helix Encase Compatible Software Suite and other Linux based market accepted solutions that help clients quickly collect and preserve relevant information.

Forensicon has the ability to remote collect single custodian windows based laptops or desktops using proprietary and licensed technology that allows Forensicon to ship its proprietary boot CD or thumb drive and assist a remote client with booting their computer into a read only state. Once booted, the custodian, with Forensicon’s telephone assistance, supplies the displayed on screen password which allows Forensicon staff to connect directly to their PC or laptop and begin the process of creating a genuine forensic image in the Expert Witness Encase Compatible format (.E0) or open DD forensic image format. The forensic image is written to an external hard drive which Forensicon supplies to the custodian along with the boot media device. Typically, the next morning, the imaging process has completed and the drive is then shipped back to Forensicon for validation and further analysis or production if required. This process has allowed end custodians to not be subject to lost business day time when the custodians elect to begin the forensic imaging process near the end of the business day. Clients of Forensicon have reported much satisfaction with this new product and have often been able to make forensic images of report custodians in countries beyond the U.S. at a cost of less than $500 each custodian in typical situations. Logical collection of file share data and email server data also can be performed using this technology without the need for expensive business travel or lost staff time.

Forensicon utilizes best in class Solid State Storage and other super-fast field equipment to minimize end party down time relating to forensic images. Forensicon has invested in leading edge technology that enables data capture rates in excess of 1 TB per hour in some circumstances. Forensicon is also able to perform large onsite collections involving hundreds of custodians and complete work in less than a single week in most situations.

Clients requiring more targeted collections can rely upon Forensicon to program EnCase Collection dongles for deployment to remote sites for self-collection of key file types within relevant time periods and according to specified keywords if a more minimized collection and cost saving maximization is desired.

Much data an organization today resides both within and outside the organization. Many companies today outsource email hosting services to third party providers also referred to cloud service offerings. Forensicon has experience collecting cloud based data stores including webmail and externally hosted Microsoft Exchange, Group Wise Mail, Gmail, Google Docs, Lotus Notes and other databases and applications.

The preservation and collection of data stored in databases and applications often requires specialized knowledge that is application specific. Forensicon staff has the experience and skills necessary to construct SQL Queries and design Crystal Reports that are often necessary to cost effectively produce relevant business information that exists within relational databases. Forensicon staff has experience reviewing database schemas of all types to assist clients with understanding where and how to obtain important relevant data that may exist as records across many databases and tables.

Copyright, trademark and patent infringement litigation cases often require the preservation of website data prior to or shortly after litigation commences. Forensicon has years of experience preserving existing public facing websites and has the ability to convert websites into bates labeled exhibits for legal filing, while maintaining the chain of custody on the original collection. Forensicon has never had any data it has preserved ruled unreliable or not admissible. Any client who may be concerned about the handling of evidence and ensuring proper chain of custody has been established and maintained can have confidence such matters are handled professionally so that they can later be authenticated and relied upon in a court of law.

If you or your client has a need to have an experienced firm of professionals assist you with a small or large electronic data preservation or collection project, call Forensicon today at 888-427-5667 for a complimentary telephone consultation or contact us.