One of the key elements in every data forensics procedure is time. Users may unintentionally or inadvertently overwrite evidence simply by continuing to complete their daily tasks. Goodenow Associates, Inc. will quickly and cost-effectively collects and preserve data or evidence that may have been deleted or become inaccessible through normal computing methods. Goodenow can determine if certain information exists and, if so, where it might be located.
When the data storage media is recovered either on location or at our lab facility, an accurate audit trail commences. The media is immediately logged into a tracking system and a log is produced. This log, suitable for all legal proceedings, accompanies the media throughout the recovery process. Goodenow investigators who handle the media ensure the continuity of evidence by adding their name, signature, date and a detailed description of what was done.
At this stage of the process, Federal Rules of Evidence apply. Goodenow & Associates, Inc.'s expertise in magnetic media storage devices begins to play a crucial role. First - the media is replicated exactly by a bit-by-bit acquisition process ensuring the integrity of the subject media is intact, and evidence preserved. Goodenow then works only with duplicate copies ensuring that no contamination of the original data takes place.
In this preliminary examination, Goodenow Associates, Inc. provides the client a detailed report outlining file structures, media integrity, and the recoverability of deleted files. This report may be used to determine if the files present will be of assistance in the investigation. Goodenow Associates, Inc. will then make recommendations how to proceed if further information needs to be retrieved. This report allows our clients to make an informed decision on the various options that may be available to them. The client's needs augmented with our recommendations assure that the time spent on the analyses is focused at all times.
