Hard drives forensic examiners tackle may be as little as 20 gigabytes, or some newer drives are 250 gigabytes, even up to 750 gigabytes.
Computer forensic examiners, using special computer forensic software, first acquire an image of the target media, then do an analysis.
A lot of the evidence you seek will not be visible to the untrained eye. You won’t find it in a Word document by using Windows Explorer, or by starting a program from a shortcut on the desktop.
The basics of computer evidence recovery
Peace of mind is yours when you entrust your investigation to us, because:
  • Our examiners, all current of retired law enforcement officers, know how to properly document chain of custody
  • They are proficient in handling dozens of different types of cases
  • Our forensic methods and processes are designed to meet potential legal challenges. They are tried and true, and backed by already established case law
  • Our forensic examiners have been thoroughly and properly trained in computer evidence processing procedures
  • Our examiners don't simply use one tool for all purposes; they have a variety of tools they regularly use depending on the situation. Often, multiple tools are used to cross-validate findings
  • We use the forensic tools specifically designed to preserve, process and document digital evidence
  • Our examiners can testify as experts in processing digital evidence
  • We maintain security so that no one sees information we are working on unless they are authorized to do so
Looking from smaller to larger digital measurements:

In all that space on a hard drive, there must be evidence somewhere!!!