Computer Forensics

The information age has brought about countless cases of illegal activities that would otherwise be impossible. This technology allows criminals to commit crimes without their faces or names ever being attached. No matter the complexity or nature of the crime, EPIS will utilize the most advanced technology and practices to ensure satisfaction on our client's behalf.

Our services regarding investigations and electronic discovery have brought a new level of standards to the industry. Call us today for a Free Consultation or E-mail us at info@epis.us

Data Recovery Process

Recovering essential data is a service that EPIS provides that combines technology and technique. Our technicians have thousands of successful cases under their belts and use the latest in state of the art equipment and expertise to recover information.

  1. Discussing the hard drive failure and gathering all the necessary information.

    Before an initial diagnosis of the problem can be made, our customer service representatives will ask you all the questions needed to determine what the true nature of the failure is and what it will take to recover your critical data.

    They ask you questions such as:

    • What is the data you need recovered?
    • What type of hard drive is it?
    • How much data is on the hard drive?
    • What happened when the drive failed?
    • How fast do you need the data?

    This only takes a few minutes of your time but is critical in making an initial assessment of the failure and what may be required to recover your data. It will also save you money when it comes time to start the recovery.

  2. In-lab diagnostic assessment

    Before the full extent of the failure can be determined, our technicians and engineers must inspect and test the hard drive in our lab. We will send you detailed instructions on how to ship the hard drive to the lab so there is no chance of further damage during shipment.

    Once your drive has arrived, it will be handled with all the care and attention you expect. Our data recovery technicians and engineers will determine whether the problem is mechanical or electrical or software related and we will take an exact image of the drive so that your original data is left unchanged.

    • We will then come back to you and explain
    • What is wrong with the hard drive?
    • What has to be done to recover you data
    • What files can be recovered
    • How long it will take
    • What the cost will be
    • We will then need your full approval to proceed

    DO NOT be fooled by companies that do not charge for this step. They will get it back in other ways that are likely to end up being much more expensive in the long run.

  3. Recovering your valuable information

    Once we have received, your approval to precede the recovery will begin. Depending on the extent of the failure, our technicians and engineers may have to replace failed or damaged components or work on the hard drive in our facility to get your data back they will use all the state-of-the-art technology and techniques developed in over 20 years in the recovery business. In addition, as we have one of the best records of accomplishment in the business with over 85% of our recoveries being successful your chances of recovery are high.

    We work at the speed you need us to. We will work 24 / 7 on emergency service to get your data back as soon as possible or we will work during regular business hours on our regular service or extended hours on our premium service. You decide what type of service level you need.

  4. Returning your data

    Once we have successfully recovered your data we will return it to you on whatever media you want. Whether it is on a CD-ROM, DVD, and another hard drive or emailed; you get the data in the format you need it in to restore it to a new hard drive and get up and running once again and with ease.

  5. Customer Service

    Once you have received the data on the type of media you want we are always available for any advice or counsel you might need to restore you data back to the way you want it. Just call our customer service representatives at 1888.404.EPIS to help in anyway, they can!

Electronic Evidence Considerations

Electronic evidence can be collected from a variety of sources. Within a company's network, evidence will be found in any form of technology that can be used to transmit or store data. Evidence should be collected through three parts of an offender's network: at the workstation of the offender, on the server accessed by the offender, and on the network that connects the two. Investigators can therefore use three different sources to confirm the data's origin.

Like any other piece of evidence used in a case, the information generated as the result of a computer forensics investigation must follow the standards of admissible evidence. Special care must be taken when handling a suspect's files; dangers to the evidence include viruses, electromagnetic or mechanical damage, and even booby traps. There are a handful of cardinal rules that are used to ensure that the evidence is not destroyed or compromised:

  • EPIS investigators only use tools and methods that have been tested and evaluated to validate their accuracy and reliability.

    In order to verify that a tool is forensically sound, the tool should be tested in a mock forensic examination to verify the tool's performance.

  • Handle the original evidence as little as possible to avoid changing the data.
  • Establish and maintain the chain of custody.
  • Document everything done.
  • Never exceed personal knowledge.

If such steps are not followed the original data may be changed, ruined or become tainted, and so any results generated will be challenged and may not hold up in a court of law. Other things to take into consideration are:

  • The time that business operations are inconvenienced.
  • How sensitive information which is unintentionally discovered will be handled.

In any investigation in which the owner of the digital evidence has not given consent to have his or her media examined - as in most criminal cases - special care must be taken to ensure that, as the forensic specialist, we have legal authority to seize, image, and examine each device. Some of the most valuable information obtained in the course of a forensic examination will come from the computer user themselves. In accordance with applicable laws, statutes, organizational policies, and other applicable regulations, an interview of the computer user can often yield invaluable information regarding the system configuration, applications, and most important, software or hardware encryption methodology and keys utilized with the computer. EPIS Computer Forensic analysis can become exponentially easier when analysts have passphrase(s) utilized by the user open encrypted files or containers used on the local computer system, or on systems mapped to the local computer through a local network or the internet.

On a summer day, an established accountant called our Computer

Forensic Data Recovery department and wanted our agents to go over his wife's computer to retrieve some deleted emails. When our team took over this assignment, the client had brought the computer to our office while the wife had gone to work for the day. The client read several incoming messages from a man she had met at a party on the previous weekend. While the message itself wasn't all that incriminating, he then went through the deleted messages on other folder, which he didn't know existed and found the more racy ones. The emails gave our client enough evidence to confront the cheating spouse.