A. YES! If they have not been completely
overwritten, yes. If partly overwritten, maybe.
If the file was fragmented before it was
deleted, recovery may be even more difficult.
Q. We have IT
people in our company. Why can't they do
the forensic investigation?
A. Although they may have a considerable amount of
knowledge and experience with computers, it is highly unlikely that
they have the required knowledge,
training, and experience of the
forensic protocols that must be observed to find
all of the evidence, protect the data, and
ensure the admissibility of evidence in civil or
criminal trials. We take steps to safeguard the
computer data; these steps require specialized
training, hardware, and software. We have the
training, experience, and tools to conduct a
thorough examination of computer data, and we are
able to interpret what we find.
In addition to the lack of skills, hardware, and
software, using a company employee can open you
up to allegations of fabricating evidence and
other impropriety. We are an independent firm,
and integrity is the keystone of our company.
Using a company employee for these tasks is also illegal in the state of Texas. Texas state law requires that each
computer forensic examiner is licensed
with the state of Texas as a Private
investigator. All computer forensic
examiners at Computer Doctors are fully
licensed private investigators.
Q. In what situations is
computer forensics helpful?
A. Computer forensics can be
used for employee internet abuse, asset discovery,
unauthorized disclosure of corporate information and data (accidental and intentional),
industrial espionage, damage assessment (following an incident),
criminal fraud, sexual harassment, deception cases, criminal cases (many criminals simply store information on computers, intentionally or unwittingly), and many
civil cases.
