A. YES! If they have not been completely
overwritten, yes. If partly overwritten, maybe.
If the file was fragmented before it was
deleted, recovery may be even more difficult.
Q. We have IT
people in our company. Why can't they do
the forensic investigation?
A. Although they may have a considerable amount of
knowledge and experience with computers, it is highly unlikely that
they have the required knowledge knowledge,
training, and experience of the
forensic protocols that must be observed to find
all of the evidence, protect the data, and
ensure the admissibility of evidence in civil or
criminal trials. We take steps to safeguard the
computer data; these steps require specialized
training, hardware, and software. We have the
training, experience, and tools to conduct a
thorough examination of computer data and are
able to interpret what we find.
In addition to the lack of skills, hardware, and
software, using a company employee can open you
up to allegations of fabricating evidence and
other impropriety. We are an independent firm
and integrity is the keystone of our company.
Q. In what situations is
computer forensics helpful?
A. - Computer forensics can be
used for employee internet abuse, asset discovery,
unauthorized disclosure of corporate information and data (accidental and intentional),
industrial espionage, damage assessment (following an incident),
criminal fraud, sexual harassment, and deception cases, criminal cases (many criminals simply store information on computers, intentionally or unwittingly) and many
civil cases
