A forensic image is an exact sector by sector copy of an entire storage drive, taken using specialized software. This image consists of all the files, as well as unallocated and un-used space. The purpose of a forensic image is to make an identical copy so the evidence on the original device remains unaltered and is necessary to produce legally admissible evidence

Unallocated space, also referred to as “free space,” is the area on a hard drive or other digital storage media where new files can be stored. Unallocated space can contain portions of data or files that have been deleted until that space is reused for new files.

Encryption is the digital process of encoding a message or data in a way that can only be accessed with a password or key. Without the password or key, unauthorized users cannot access the data.

Each case varies depending on the quantity and complexity of evidence required. Typically a case can take anywhere from 10-40 hours and between 2-6 weeks to complete. We will better be able to determine the time your investigation needs when we have the opportunity to speak.

Because digital forensics is a science, highly skilled expert examiners must perform a series of steps from the beginning of the investigation to the end. This can take a significant amount of time and labor to produce a legally valid report. The cost of a forensic examination depends on many factors, from lab time to hardware and software requirements to the capacity of data being sought. We offer clients project specific pricing, once we present the pricing, it will be honored unless the clients requirments change.

-Or-

We are able to perform our services on an hourly basis.

A court order signed by a Judge in the United States or you are lawful owner of the device.