One of the most important parts of a forensic examination is learning and advising what evidence may be available.  If an examination has already been done it is critical to review and critique that examination.

Make a working copy of the data using standard procedures that cause little or no change to the source data.

It is essential to maintain the data using proper procedures to prevent changes to the stored data and in a format that is compatible with a variety of forensic software tools.

Data recovery is a significant element of computer forensics and is the usual first step in a forensic examination. After the data is recovered, an examination should locate the appropriate related metadata and determine its significance. A forensic examination is an investigation of the data. As with any investigation the forensic examiner endeavors to determine who, what, when, where, why, and how concerning the relevant data.

Will Docken Investigations will report to the client the results of the examination and if required present expert testimony in a court or other proceeding.