Mares and Company, LLC provides Computer Forensic services in several areas:

Overview of Computer Forensics

Computer Forensics includes the acquisition, analysis, and preservation of electronic data in a manner which ensures its admissibility as evidence in court. The proper handling of this computer-stored information can be vital to the successful resolution of a variety of criminal and civil matters.

Computer forensic services are useful to individuals, businesses, attorneys, and the courts. Our services are helpful in a variety of employment and human resources matters: where disciplinary action is under consideration; after an employee has been fired; where there is a question about improper use of computers. Corporate internal security investigations often rely on an expert review of computer evidence, as do insurance company investigations. And fraud examiners today will find most of their evidence on computers and it must be handled within a forensic protocol.

Computer Forensic Services from Mares and Company, LLC

At Mares and Company, LLC our services are founded on extensive experience in the areas of both investigative law enforcement and computer software development. In our forensics practice we use a variety of computer tools. Many of them are our own Maresware software, which is widely used by law enforcement, intelligence agencies, the military, and corporations around the world.(Read more about the history of our work in the emerging field of Computer Forensics at About Us.)

We believe that this high level of skill in forensic software development gives us a clear edge in both our forensics work and in legal proceedings. We have the technical knowledge to clearly present and explain our procedures and findings. And to formulate approaches for challenging other experts as well.

Top

Electronic Data Discovery & Evidence Analysis

Our examinations are conducted within a strict forensic protocol. We can identify, retrieve, and safeguard the computer information relevant to your needs. And the chain of custody of the original evidence is always documented.

Where We Look

A broad spectrum of electronic data exists: e-mail; word processing documents; evidence generated by the computer itself, including evidence of Internet browsing; files in databases, spreadsheets, and so on. This data is stored on hard drives, floppy disks, CD-ROMs, zip disks and on other storage media. Furthermore, the data of importance to you may be contained not only in active files, but also in areas not normally seen by the operating system. In this unallocated space and file slack is where we can find previously deleted files and Windows swap files(Windows' temporary work space, where everything ever typed on the keyboard is recorded.) If there were intentional efforts to hide or destroy data, much of it can be successfully located here and recovered. All of these areas must be addressed in a complete forensics examination.

How We Proceed

Any inquiry may uncover information that can end up in court. To safeguard potential evidence, the examination should proceed within a strict forensic protocol. Our examination starts with the creation of an exact image(copy) of the hard drive(or other media). This working copy is used so that the original is never at risk of contamination. Next we validate the working copy to document its authenticity as an exact copy of the original data. This process, and every other step of our investigation is completely documented.

The analysis of the data itself may involve many techniques, some of which are: password cracking to access files; keyword searches to uncover your targeted information; document extraction; recovery of deleted or hidden data. A complete report of our procedures and findings is provided in the format you specify, written or electronic.

Top

Expert Witness Testimony

We are prepared and experienced in giving statements at depositions and testifying in court. We can explain our own findings in an investigation, appear as a technical expert to explain the computer forensics process, or provide the expertise to challenge another witness in court. We can assist with the preparation of technical questions to use in questioning other witnesses or experts. It is sometimes helpful for us to sit in on a deposition and provide impromptu questions for use in deposing a witness.

Top

Other Forensic Services include: computer security and information privacy services; hard drive imaging; and Bates numbering

Computer Security and Information Privacy

We provide a variety of services in this area. Several are listed below:

• review of a terminated employee's computer use and contents
• assistance with internal security investigations
• inquiries into possible computer misuse or corporate policy violations
• detection of data alteration
• performing hard drive wiping prior to the drive's reassignment, retirement, or donation. Our wiping procedures meet or exceed DOD(Department of Defense) standards and are useful in HIPAA compliance and other information privacy regulations(learn more about our process at Hard Drive Wiping or purchase the software and do the work in-house)
• furnishing and installing hard drive identification software to assist in recovery of stolen computers or for tracking assigned computers in-house

Top

Hard Drive Imaging--Why use a forensic imaging process?

A forensically imaged drive is absolutely critical in the case of litigation or of normal business records which could be useful should litigation arise. Our forensic imaging process captures all the data, including erased data, hidden files, Windows swap files, unallocated space, temporary files, etc. Often your best evidence is here, in areas where a computer user sought to alter or destroy data and inadvertently laid down evidence of his activities. Read more technical information about forensic imaging versus other imaging services we offer at Hard Drive Imaging.

A forensic imaging process can be just as useful in the safekeeping of important business records. As protection in case of catastrophes such as theft, fire, and system crashes, businesses should have an exact image of their hard drives(and should periodically update these copies.) All of our imaging is performed to a forensic standard, which goes beyond traditional drive copying methods. The difference is that instead of copying only the files currently visible on the drive, a forensic imaging process copies the entire drive. This includes all the empty space, where any previously deleted files reside. When you restore data after a catastrophe, for example, you also want the ability to recover deleted files, as you normally have. With a forensically imaged drive you will have that ability.

Top

Bates Numbering to identify your e-documents

Using Maresware Bates_no software and a working copy of your e-documents we assign Bates numbers, preparing your documents for discovery or evidentiary use. The process is very fast. Or, purchase our software and do all your own work in-house. (We can train your staff if needed.)

Read more about Bates_no software.
Also available for Linux. See Maresware: Linux Forensics.

Top