WARNING                   WARNING                          WARNING

Using our service can be very revealing.  

Just imagine every search, every picture ever looked at, every email read, every web site visited, anything done on a computer has left digital traces behind.

Much more information is retained on a computers hard drive then most people realize. A computers operating system never intentionally erases anything even when the user intentionally deletes a file. Instead the operating system just hides the deleted files contents from view.

Getting the hard drive as soon as possible in an investigation that involves computers is the most important step in a computer forensic investigation. Getting the hard drive means securing a forensically sound bit stream image or clone of the hard drive.

In an effort to keep cost down Signum Intelligence offers three levels of service:

Drive Imaging (Preservation): 

     Is the least expensive but most important part of any computer investigation. At Signum Intelligence we offer and highly recommend that when a situation comes up involving computers that a forensic bit stream image be created immediately. This will basically freeze that hard drive in time and be available for later analysis.
     This service is recommended to companies that have any turnover of employees. Issues and allegations involving previous employees can arise months or even years after they had left the company. Having an exact duplicate of the assigned computer or computers can provide evidence of wrong doing by the employee or evidence of the company’s innocence.

Preview:

     Is a preliminary assessment of a hard drive for possible evidence. This service is for the client who is not sure if there is any evidence on the computer in question. This is basically a quick look at the contents of the hard drive.

Examination and Analysis:

     A computer forensic examination consists of the acquisition and analysis of the computers hard drive. The acquisition is creating an exact copy of the media; this copy is then used for the analysis. The analysis is used to locate crucial evidence in deleted files, information hidden outside the normal storage areas, partially overwritten older data or data that resided in the computer’s memory cache or other temporary artifacts. This type of examination also allows for specific files, processes or keyword searches. This type of analysis is what makes computer forensics such a powerful investigative tool.