A full forensic exam will be performed on all cases that might one day end up in court. There can be no exceptions to the procedures involved in this exam. The reason for such a strict protocol is to insure that all recovered data has been obtained in the proper way using court approved methods. This exam will begin with a complete image of the target hard drive, the image will be made using a blocking computer bridge so that absolutely no data is written to the target drive, once the image is made the two will be compared using the hash values of each. The imaged drive will then be the one analyzed for evidence recovery. A complete exam will then begin. 

   The scientific possibility of two different objects having the same MD5 hash value is more than 1 in 340 undecillion. (that is 340 with 36 zero's )

This makes Forensic data recovery a "HARD" science and much better then even human DNA.

   This type exam should provide the client with the ability to have court testimony in any type of court hearings.

   The analysis is based on search parameters you provide. Once you have advised what you are looking for the analysis process will begin. This can take from several hours to several days depending on the complexity of the parameters and the size of the data to be searched. This is the phase where e-mail, photos, movies, Documents, spreadsheets, hidden data, and all other data will be located and preserved.

A detailed report will then be produced and a CD/DVD will be provided containing all target items recovered.