DTI Data offers a range of expert witness services

DTI experts have provided expert witness services such as testimony to both plaintiffs and defendants in civil law proceedings. We have also served as technology and forensics experts for prosecutors and defendants in criminal law matters and provided expert testimony in local, state and federal courts across the country.

DTI Data’s forensic specialists always follow forensic preservation process

There are three key steps in the forensic process that must be followed: acquisition, analysis and reporting. All steps must meet certain criteria and guidelines in order to be accepted by the court as true and correct. The data cannot be altered in anyway and must have an accurate chain of custody that includes anyone who had access to the data. All results must be verifiable and able to be duplicated by another expert. When providing our expert witness services we adhere to the strictest guidelines and have a proven track record testifying in courts and presenting digital evidence. When one of our experts testifies on the stand as an expert witness, their findings are presented in a professional, easy to understand method that has all the technical fact and explanations needed to validate that the findings are true and accurate.

Acquisition

The first step in the process is acquiring the source media. The source media in the forensic process must be acquired by tools that make an exact image or clone using SHA-1 or MD5 hashes. The image or clone is acquired using write blocking hardware or software to prevent any alteration to the source media.

Analysis

The second step in the process is analyzing the acquired media. This process involves specialized software that will find both latent and active data. This is often based on keywords relative to the investigation. The types of data searched for or found may also be relative to the investigation and can include images, internet cache, deleted email messages, meta-data found in images, etc.

Reporting

The final step in the process is reporting. The examiner will document the entire process in a report that outlines the process, the examiner’s findings and conclusion, all in a format that is easily understandable. The report is usually provided to legal counsel or law enforcement.

Preservation of documentation and custodianship of source media must be maintained throughout the entire process until all litigation or analysis is finalized. Failure to diligently document the process could jeopardize the validly of the examiners findings.

Make sure you use skilled experts. Give DTI a call at (866) 438-9632