1.  What are the examiner's qualifications? 

• Can the examiner testify in court for you if necessary? 
• Has the examiner testified in court previously? 
• How many forensic examinations has he or she conducted in the past?
• Do they hold any certifications in computer forensic examinations? 
• Where did they get their training? 
• How long has the examiner been conducting examinations?  (Not just how long has the company been in business). 
• Is the examiner an employee of a data recovery company who has decided to delve into forensics?  A computer forensic examination is a highly specialize form of data recovery, but merely being good at data recovery does not necessarily make them forensic examiners.  You need to check their forensic qualifications. 

3. Is the examiner familiar with the particular operating system that you wish examined? 

• What type operating system are you dealing with? 
• Is it a standalone computer?
• Is it DOS, Windows, MAC or Unix?
• Is it a network? 
• If so, what kind of network? 

• Is this a voluntary or an involuntary collection of data? 
• What procedures does the examiner recommend to preserve the original data during acquisition? 
• Will the recommended procedures reduce the potential of someone trying to destroy evidence while it is being collected? 

• Will these procedures prevent the introduction of viruses and prevent the accidental destruction of data? 
• Does the examiner work from a forensic or bitstream copy? 
• If so, what software do they use? 
• If not, completely avoid them!!! 

• Have them simply explain how files are stored, deleted and recovered. 
• Have them explain how Windows long file names are stored and recovered.  Ask them if the long file name must be recovered? 

• Have them simply explain what happens when a drive or diskette is formatted and how this data is recovered. 

• Have them explain some common methods used to hide files. 

• Have them explain the two basic methods used to password protect files or data. 
• Do they use software solutions? 
• If so, what software? 
• How do they approach RSA, PGP or other difficult to break password protection schemes? 

• What is the exact file name of the Windows swap file? 
• Where is it normally stored? (2 places) 
• Is it dynamic and how big can it become? 
• Have them explain what general types of applications keep temporary files. 
• Have them discuss internet cache files. 
• Have them explain cookies. 

• What dates and times are stored in all Windows file entries? 
• Were all of these entries stored in the DOS 6.22 (or below) file entries? 
• Have them explain compound documents.

• How does the examiner do this? 
• What software is used? 
• How thorough is this search and recovery of data from unallocated space? 

• Printouts? 
• CD ROM? 
• Can the examiner convert the format of the data to a format that will be useful  to you? (i. e., convert proprietary database or spreadsheet data into something like Microsoft EXCEL?) 

• The examiner should fully understand the "Rules of Evidence" as they relate to storage of evidence and "chain of custody".  Your case could be lost here, if the "Rules of Evidence" are not followed. 

16. Is this a large company that considers you one of many clients or will you get personal attention? 

17. Will the report be clear and explain any technical issues in a manner that are understandable by all parties involved? 
 

 
Contact us at

(305)453-7862

or