ESI Consulting

Computer Forensic Services

ESI Consulting offers a full range of computer forensic services. Our services vary from engagement to engagement, depending upon your needs, goals, and the ESI we are working with. The following is a general overview of some of the basic computer forensic services we offer:

-          Create forensic image

-          Hash hard drive

-          Hash forensic image

-          Backup image onto DVD

-          Create log file

-          Prepare chain of custody documentation

-          Prepare affidavit

-          Clone hard drive (if requested)

-          Thoroughly search file system data structure

-          Search file header signatures (searches for files still on drive but no longer referenced in MFT)

-          Compute hash for each file (options include checksum, CRC, MD5, SHA-1, SHA-256)

-          Verify file types via signatures and algorithms (e.g. checks for files word documents saved as images)

-          Extract emails and attachments (from PST files, AOL pfc, etc.)

-          Search for images embedded in other files (optional)

-          File encryption tests (checks for encrypted files)

-          Create list of directories and files on drive (includes metada such as date and time created, modified, accessed, file size, file location, file path) filterable and sortable format

-          Create log file

-          Consult on search terms

-          Conduct searches

-          Analyze results, conduct additional queries or analysis as determined necessary to be as accurate and complete as possible

-          Filter out irrelevant files (system files, drivers, help files, etc)

-          Create list of files that could not be searched

-          Review and analyze files that could not be searched

-          De-dupe results based on hash or other agreed upon criteria

-          Create list of files per search term

-          Extract files and search hits and provide to client in native format

-          Crack password protected files

-          Consult on search terms

-          Conduct searches of ambient data (swap file, file slack, unallocated space)

-          Search for and retrieve IM chats and Webmail

-          Analyze results, conduct additional queries or analysis as determined necessary to be as accurate and complete as possible

-          Analyze results, separating true hits from false hits

-          Segregate true hits from ambient data

-          Mark excerpts

-          Extract excerpts into files

-          Index excerpted files

-          Hash excerpted files

-          Create list of extracted excerpts per search term

-          Provide excerpted files to client

-          Create log file

-          Convert files into tif or pdf format. Includes

-          Imaging

-           OCR

-          Bates numbering

-          Metadata

-          Load file creation

-          Load files

-          Load metadata

-          Bates numbering

-          Source coding

Comments? Questions?

Please feel free to send us your comments or questions about ESI Consulting, computer forensics, or the services we offer.