Forensic Imaging

• Create forensic image
• Hash hard drive
• Hash forensic image
• Backup image onto DVD
• Create log file
• Prepare chain of custody documentation
• Prepare affidavit
• Clone hard drive (if requested)

File System Analysis

• Thoroughly search file system data structure
• Search file header signatures (searches for files still on drive but no longer referenced in MFT)
• Compute hash for each file (options include checksum, CRC, MD5, SHA-1, SHA-256)
• Verify file types via signatures and algorithms (e.g. checks for files word documents saved as images)
• Extract emails and attachments (from PST files, AOL pfc, etc.)
• Search for images embedded in other files (optional)
• File encryption tests (checks for encrypted files)
• Create list of directories and files on drive (includes metada such as date and time created, modified, accessed, file size, file location, file path) filterable and sortable format
• Create log file

Searching and Analyzing file system data

• Consult on search terms
• Conduct searches
• Analyze results, conduct additional queries or analysis as determined necessary to be as accurate and complete as possible
• Filter out irrelevant files (system files, drivers, help files, etc)
• Create list of files that could not be searched
• Review and analyze files that could not be searched
• De-dupe results based on hash or other agreed upon criteria
• Create list of files per search term
• Extract files and search hits and provide to client in native format
• Crack password protected files

Searching and Analyzing ambient data

• Consult on search terms
• Conduct searches of ambient data (swap file, file slack, unallocated space)
• Search for and retrieve IM chats and Webmail
• Analyze results, conduct additional queries or analysis as determined necessary to be as accurate and complete as possible
• Analyze results, separating true hits from false hits
• Segregate true hits from ambient data
• Mark excerpts
• Extract excerpts into files
• Index excerpted files
• Hash excerpted files
• Create list of extracted excerpts per search term
• Provide excerpted files to client
• Create log file

Imaging Extracted Files

• Convert files into tif or pdf format. Includes:

• Imaging
• OCR
• Bates numbering
• Metadata
• Load file creation

Loading Electronic Files into Summation (or other software)

• Load files
• Load metadata
• Bates numbering
• Source coding

Expert Witness Testimony

We provide expert witness testimony in state and federal court.

E-Discovery Consulting and Services

Whether you are producing or requesting E-discovery, ESI Consulting can help you

• Determine what ESI to look for and where it may be found,
• Acquire the ESI (in a forensically sound manner if necessary),
• Process the ESI for review,
• Review the ESI, and
• Produce the ESI.

E-Discovery is much more than copying files and searching for words. There are many factors to consider, such as whether deleted information or unallocated space may contain ESI, how is the ESI to be acquired, who will acquire it, should it be acquired forensically, in what format will you review the ESI, how much ESI will you have and how will you review it, who will and how will it be de-duped, in what format will it be produced, who will process it, who will be able to authenticate the ESI in court, how will the ESI be authenticated, how long everything will take and how much it will cost.

Other Services

ESI Consulting offers many other computer forensic services. The items above are the most common. Other services will be provided based upon the specific requirements of the engagement.