Digital Forensics

Data can be vital in building a solid foundation for a case. Recovery is not simply a matter of retrieving lost data in any way possible. To be admissible in court, certain procedures must be adhered to and failing to take these steps risks contaminating the evidence and rendering it useless. Using our years of investigative knowledge and integrity-oriented approach, the McDonald & Associates team can serve clients far more superior than other IT firms.

McDonald & Associates Digital Forensics & Preservation utilizes state-of-the-art technologies and is able to recover data from a number of different media, including:

• Hard Drives
• Back-up Storage Media
• Databases
• E-mail
• Web Servers
• Internet Sites (visited)
• PDAs
• Mobile Phones
• Digital Cameras
• Zip Drives

Computer forensics can be defined as the collection, preservation, analysis, and if needed, the court presentation of computer-related evidence. Why do we need computer forensics? Because a vast amount of information can be found and stored in computers or digital media. Even if a file has been deleted we may be able to recover it. Our computer forensics specialists use state-of-the-art tools and procedures to confidentially recover, safeguard, analyze, and present data extracted from various computer storage devices. This enables us to identify individuals, motives, and their methods.

With the majority of the world’s business documents being drafted on computers and the use of e-mail, instant messaging and internet business by nearly everyone, much of today’s civil litigation evidence can be derived from computers. McDonald & Associates computer forensic investigation team possess the ability to locate and recover any and all relevant information or traces of data that may exist on a computer or storage device. This includes recovering items such as e-mails viewed but not “saved,” websites visited, deleted documents, uninstalled software, etc. The great news about this type of data is that unlike a piece of paper which only shows us what we can see, electronic data can have information about it’s creation, multiple versions of that information, who it was transmitted to, location of data accessed, history of its use, etc. We are proud to say that if a piece of information exists on a computer or storage device, we will be able to locate it and reproduce it for inclusion in evidence.

Our computer forensic investigations are conducted in a forensic lab, thus preserving the integrity associated with that piece of electronic evidence. As Washington licenses private investigators, we are in a far better position to find evidence than IT firms because we already have the investigative knowledge, training, and mindset. We use court recognized software programs and tools to employ along with our vast experience in both the technological aspects as well as industry standard investigation practices.