Computer forensics is the scientific process of searching electronic media for evidence pertaining to a legal, or potentially legal matter. It is more detailed than data recovery and the process occurs in three steps: acquisition, analysis and reporting. That is, data is first acquired and then thoroughly analyzed. Finally, the findings from the analysis are clearly and thoroughly reported. This process ensures that the data which you are presenting in court is relevant and irrefutable.

Unlike their paper counterpart, electronic documents can exist in many different forms. Electronic documents can show an historical progression of the document from its inception to its termination (or deletion) lending significant insight as to how certain things were created. Furthermore, computer forensics is the science of retrieving these documents from electronic systems and presenting them in an easy-to-understand manner. It is important, however, that the experts you decide to contract are skilled, or certified, in the many different technologies available today.

The Sherlock Forensics' team has developed an approach to computer forensics which allows for the efficient and thorough recovery of relevant documents needed for your case. To begin, you will meet with one of the forensic examiners to discuss the specifics of your case. In order to quickly determine where documents exist and how to best retrieve them, it is important to discuss what you are seeking. Secondly, the examiner will develop a detailed plan on how to appropriately approach this task. You will then be advised of the most suitable options available in order to ensure a quick and undisturbed collection of evidence. Once an option has been selected, the experts at Sherlock Forensics will acquire the evidence needed.

It's understood that real life situations may not allow for important computer systems to be simply turned off and shipped to our lab. As a result, we have developed a unique "Mobile" forensics lab that accompanies our forensic examiners to the identified computer location. Once on site, the evidence can be acquired from the system as if it were in a lab.

Utilizing the latest and most reliable forensic hardware and software, Sherlock Forensics will skillfully acquire and preserve the electronic documents needed for your case. Sherlock forensics always makes a backup copy of any data acquired to ensure that the original evidence obtained remains unaltered from the time of acquisition to the time it is needed for presentation. One method which we employ is the use of MD5 and SHA hash algorithms. These sophisticated algorithms allow Sherlock Forensics to digitally "sign" acquired evidence, thus authenticating it. It may take years before evidence is required and this signing process enables you to prove that the evidence has not been tampered with since the time of acquisition.

Sherlock Forensics has developed methods to allow for the easy viewing of evidence obtained that does not require specialized software or an expert to understand. We will clearly and thoroughly explain what the data stands for in its current form, where the data was located, how the data got there, information regarding attempts to hide or destroy evidence, and provide timelines representing the events in the order in which they occurred.

The goal at Sherlock Forensics is to present evidence which is relevant and helpful to your case in a way that even non-experts can comprehend. Reporting the findings of a computer forensics investigation typically occurs in two steps. Initially, a Sherlock Forensics examiner will convene with you to present the evidence in person. Once you are satisfied with the results, a full forensic report will be produced containing our expert opinion on what the evidence says, supported by factual exhibits which will ensure its validity and authenticity.