Digital Forensics
Cornerstone’s standard best practices for handling evidence include measures to ensure that it is not altered in any way during the collection process and can be safely preserved. Cornerstone employs the latest advanced tools and software such as write blocking appliances which prevent change or damage to originals. Specialized forensic tools and processes such as hash comparisons are used to verify that an exact copy is acquired and preserved.
Expert Testimony
Cornerstone experts cannot only develop a defensible process based on best practices and the Federal Rules, they will also testify in hearings or in court as to the validity of that process. Cornerstone can also provide expert services to audit and analyse the preservation efforts of opposing parties and provide documentation in support of briefings.
Cornerstone’s Computer Forensic Services include the following disciplines:
- Collection planning
- Link analysis
- Data preservation and collection
- Advanced forensic analysis
- Computer user profiling
- Password decryption
- Data imaging
- Cell phone seizure and data acquisition
- Email server mailbox collection & verification
- Cellular phone analysis
- Advanced email investigation
- Evidence custody chain and
- Digital investigation reporting
- Inventory tracking
- Expert testimony
- Preliminary forensic culling & filtering
- Declaration and reporting
- Exhibit production
- Deleted file recovery
- Registry analysis
Cornerstone provides its clients with cost efficiency in the forensics process by designing a specific solution based on the needs of the client and the matter. In addition, Cornerstone helps its clients save throughout the discovery process by forensically and defensibly culling data. Forensic Culling reduces the amount of data that must be subsequently processed and searched from custodian hard drives after they’ve been collected and imaged in the field. Typical forensic reduction only involves the elimination of system files by using NIST or NLRS known system file lists as a guide, but Cornerstone’s Forensic Culling goes beyond traditional de-NISTing to include and isolate other extraneous folders such as program files or IT user accounts. These can hold large volumes of data that are typically not useful or relevant for electronic discovery review. For example, the PC may contain a profile which is merely used for IT administrative purposes to store a backup of the installation set or standard package of applications, utilities and shortcuts to resources that are deployed for all users within their organization. Cornerstone individually can confirm each such case and omit them from the data extractions where appropriate. Typically, less than 50% of the data remains to be forensically extracted, resulting in a greater than 50% reduction in downstream processing, hosting and review costs.
