Frequently Asked Questions

One of the key elements in every data forensics procedure is time. Users may unintentionally or inadvertently overwrite evidence simply by continuing to complete their daily tasks. Goodenow Associates, Inc. will quickly and cost-effectively collects and preserve data or evidence that may have been deleted or become inaccessible through normal computing methods. Goodenow can determine if certain information exists and, if so, where it might be located.

When the data storage media is recovered either on location or at our lab facility, an accurate audit trail commences. The media is immediately logged into a tracking system and a log is produced. This log, suitable for all legal proceedings, accompanies the media throughout the recovery process. Goodenow investigators who handle the media ensure the continuity of evidence by adding their name, signature, date and a detailed description of what was done.

At this stage of the process, Federal Rules of Evidence apply. Goodenow & Associates, Inc.'s expertise in magnetic media storage devices begins to play a crucial role. First - the media is replicated exactly by a bit-by-bit acquisition process ensuring the integrity of the subject media is intact, and evidence preserved. Goodenow then works only with duplicate copies ensuring that no contamination of the original data takes place.

In this preliminary examination, Goodenow Associates, Inc. provides the client a detailed report outlining file structures, media integrity, and the recoverability of deleted files. This report may be used to determine if the files present will be of assistance in the investigation. Goodenow Associates, Inc. will then make recommendations how to proceed if further information needs to be retrieved. This report allows our clients to make an informed decision on the various options that may be available to them. The client's needs augmented with our recommendations assure that the time spent on the analyses is focused at all times.

Just as Law Firms, Government agencies, and other businesses who maintain proprietary information have their offices swept for listening devices, they often overlook the most obvious and vulnerable source of information that also can be illegally monitored - your network!

Goodenow Investigators are experts in the field of Technical Surveillance Counter Measures; known in the field as TSCM. Our staff will audit the individual machines and network for such intrusions as well as provide a valid architecture of your entire network outlining the vulnerabilities that provide intrusion methods for attackers.

If and when these rogue process are identified, they are preserved into evidence. At that time, our investigators will initiate and investigation in effort to identify the source of the mole. Responsible parties are then identified for the client for their effective criminal prosecution and/or civil remedy.

Electronic Discovery

• Define clear objectives for the discovery process
• Develop effective discovery demands based on defendant or plaintiff cases
• Determine the optimal balance between legal and technical strategies
• Execute a case-specific plan for discovery quickly and cost-effectively
• identify precedents and assist in motion development

Evidence Processing

• Restore, search, filter and consolidate data, e-mails and files from any type of media including hard drives, backup tapes, CD-ROM, floppy disks and Zip disks
• Reduce risk of loss of original data as evidence can be processed onsite at the Client's facility

Investigations

• Skilled investigators know where to find evidence and how to manage it through proper chain-of-custody techniques
• Specific methodologies help ensure the investigation is verifiable and repeatable
• Expert investigators skilled at acquiring and delivering evidence from hostile and friendly environments
• Quick evidence delivery via our proprietary technology

Expert Witness Testimony

• Expert, knowledgeable testimony gained from hundreds of hours training, casework, and on the witness stand for some of the world's largest corporations and law firms
• Professional preparation demonstrates fact, methods and results of the electronic discovery process
• Court-experienced professionals deliver expert witness testimony to support case-specific objectives

Before settling or even approaching a lawsuit, Goodenow investigators will assist in the implementation of a legal strategy by combining expertise in data extraction, information processing, and electronic evidence protocols to ensure a strategic advantage for your client in evaluating and responding to investigations and lawsuits.

Goodenow enables clients to collect, recover, process, and review electronic data regardless of media type and without recreating the native environment. Competitors must recreate the hardware and software environment of the original document meaning additional time and cost requirements.

In both civil and criminal issues, there are times when you know or suspect that there is evidence on a computer hard drive or tape that has been hidden, tampered with, deleted or otherwise damaged, and you need the information. Whether the cause is a disgruntled employee who "wiped out" his computer before leaving or individuals trying to hide evidence of fraud, sexual harassment or embezzlement, or trying to hide the misappropriation of customer files, proprietary processes or customer lists, the process of recovering the information is similar.

If you believe that you have a computer that that contains evidence, discontinue its use immediately. If it was left running, leave it on, if not, leave it turned off. Attempting to access the computer in any way, may change the data contained in the drive or activate a pre-programmed set of instructions to alter the content of the drive. Continuing to use the computer can also innocently overwrite the evidence making it permanently unavailable.

In many cases the evidence is still on the hard drive and requires skill and experience in data recovery to identify and retrieve the key data. Our experts can safely enter any system, network or data storage device to recover data and determine whether it has been tampered with, deleted or damaged. Depending upon your needs, experts can search for specific data, phrases, files, numbers or keywords; determine when data was accessed; or verify illegal use of proprietary information.

The only way to assure that all available evidence is secure is to isolate the electronic media involved and secure it in such a way as to satisfy, in court, that the original data was not modified. Ideally, remove the hard drive(s) from all computers involved.

Be sure of your expert! If an attempt has been made to delete, erase or otherwise hide critical evidence, it is very important that an experienced, data recovery professional search for, and retrieves the missing information. There are many excellent software products on the market, which when used as designed, can recover lost or hidden data. However, these software products can also permanently damage or loose data which otherwise could be recovered. You are risking your one chance of recovering critical information by using commercial software. If you have lost data that is critical, search out a competent data recovery professional.