We recommend that you DO NOT attempt to search for the evidence yourself because this will change important date/ time stamps as well as user information, thus, possibly obstructing the investigation.
In most cases, verify the origin of E-mail and other types of computer network-based communications.
Identify techniques employed by the sender to mask or hide who actually sent the E-mail message.
Provide consultation and guidance for the generation of subpoenas for use in compelling the production of relevant evidence by Internet Service Providers that can be used to identify the person who sent the E-mail message.
Our primary job is to preserve the computer evidence and to transport the computer to a safe location where a complete bit stream backup of all stored data areas can be made. You also want to insure that the computer system can be reconfigured to match the configuration in which it was found. For this purpose, it is wise to take pictures of the complete computer system from all angles. Wires should be marked such that they can be easily reconnected. Also, the computer should be clearly marked as evidence and stored out of reach of inquiring co-workers. Chain of custody is as relevant when it comes to computers as any other form of evidence.
Law enforcement agencies have come under scrutiny regarding evidence issues. For this reason, it is important for the computer investigator to document everything, as they will be testifying in court.
Every effort must be made to show that no one could have made changes to the information contained on a computer system. Without such assurances, countless hours of processing effort may prove to be wasted time and the case may be lost at trial.
For data recovery services, please visit Data Recovery Link at www.datarecoverylink.com/