• Was there adequate probable cause to seize or collect the computer system? 
• How was the computer shut down? 
• Was every effort made to preserve the data on the media? 
• How was the computer secured and transported? 
• Where and how was the computer stored? 
• Who conducted the forensic examination? 
• Was the software used by the examiner properly licensed? 
• Was the media used by the examiner forensically sterile and wiped of any previous case data? 
• Were there techniques used to protect the original media from being altered? 
• Was the seized/collected hardware physically examined and the description properly noted? 
• Did the protocols and procedures used during the examination prevent loss or alteration of data (either accidental, by viruses or by "booby traps")?
• Were all areas of the media examined? (sometimes this is not necessary or possible). 
• Depending on the type evidence involved, was there any exculpatory evidence on the media? 
• Was there a listing made of all of the files contained on the media? (we should be able to answer "exactly what was on that computer?"). 
• Was the evidence found on the computer properly documented, stored, controlled and transmitted? 
• Was the examination thorough? 
• Was the examiner's report thorough and did it make sense?  Did the report adequately explain technical issues? 
• Were opinions or conclusions made by the examiner consistent with the evidence and explained in a manner that would be understandable in court?
• Can the person conducting the examination introduce the evidence in court?

 
Contact us at

(305)453-7863

or