Lone Star Forensic Group

          Computer Forensics, which is also called "Hard Drive Forensic's", is usually describe as the examinations of Desktops, Laptops and Server’s, as well as secondary storage devices such as External Hard Drives and Flash Drives.  In Digital Forensics such examinations can vary greatly based upon an examiner’s training, experience, and available tools.  As with other types of forensics,  a single approach can often miss crucial information that can make the difference in the case.

​

Important Factors in a Hard Drive Forensic Examination

1.) Evidence Integrity- an examiner should always treat a case like its going to trial. Every piece of evidence should be the most important piece of evidence and treated as such.

​

2.) Chain of Custody- A device’s travel should be recorded from seizure through examination.

​

3.) Imaging-  A proper examination starts with the imaging process.  A device’s data should be protected during this crucial process. This requires the right tools and training.  A failure at this stage throws the entire examination in to question.

​

4.) Examination- The right tools in this process is crucial. The correct tools are expensive and difficult to master.  Our examiner’s have access to the industries gold standard products such as Encase and FTK, as well as the cutting edge technology such as IEF, Macquistion, Backlight, and Gargoyle.

​

5.) Reporting- All of the skill and work that goes into Stages 1-4 can be for nothing if the results are not properly reported.  The results needs to be provided and conveyed to the right parties in manner in which they can understand and make use of.  In many cases, testimony in front a judge or jury will be required.  Our examiners have testified in numerous courts all over the United States.  We have the ability to convey technical data in a way that is understandable and relatable.

​

Mac Forensics

​

          Forensic examiantions on an Apple Operating System require techinque, training, tools, and experience different from traditional windows systems. System reports are located in different containers and require different skill set to acquire, process, and analyze.  The imaging techniques for an Apple Computer require a different set of tools and skillset to properly acquire the data without damaging the physical components.  

 

            The Lone Star Forensic Group has invested in significant infrastructure, tools, and training to properly handle these incredibly popular devices.  Our examiners have analyzed hundreds of such devices.