Pinpoint Labs

What is a Forensic Image?

‘Imaging a hard drive’ is a phrase that is commonly used for preserving the contents of a custodian hard drive or server. It can also be used to describe when a custodian hard drive is cloned. It is worth taking some time to…more

| Electronic Discovery

Recovering Deleted Email

It’s important to understand that deleted email is not recovered or indexed using common litigation support or electronic discovery software. These applications only process email that is still visible within the email…more

| Electronic Discovery

Preserving Suspect Media (Write Blockers)

When examining or processing the files on a hard drive, it is extremely important to retain the original file contents and time stamps. Many people don’t realize that just connecting a hard drive to a PC will alter the contents…more

| Electronic Discovery, Law Practice Products & Services

Recovering Files From Unallocated Space

Recovering data from a hard drive is one of the most common tasks during a computer investigation. Here are a few of the artifacts which computer investigators may retrieve from unallocated (free) space to assist in a case: *…more

| Electronic Discovery, Law Practice Products & Services

Secretly Copying Files To An External USB

Copying corporate data and using it at a competing company (intellectual property/corporate asset theft) is a common and serious concern for companies and their legal counsel. When employees leave companies, there are often…more

| Electronic Discovery

Searching for Buried Treasure

Searching and identifying relevant content is a common process for both electronic discovery and computer forensic investigations. But some people don’t realize the challenges associated with indexing hundreds, or even…more

| Electronic Discovery, Law Practice Products & Services

ESI (Electronically Stored Information) Software Challenges

A couple weeks ago, I outlined what computer forensics and electronic discovery have in common and how they differ. I’d like to expand on this topic by identifying some common obstacles encountered when using popular computer…more

| Electronic Discovery, Law Practice Products & Services

Metadata Analysis - “Fabricated” Documents

One of the common requests we receive is to help a client determine when a document was created, or if it existed at a specific date and time, and when it was last modified. For example, an employment dispute may involve one of…more

| Electronic Discovery, Law Practice Products & Services

ESI (Electronically Stored Information) Winds of Change

Changes are underway in how electronically stored information (ESI) is processed and reviewed. These changes are due to the huge size of repositories - hundreds of gigabytes or multiple terabyte sizes - identified for collection…more

| Electronic Discovery, Law Practice Products & Services

When is a Computer Forensic Investigation Needed?

Electronic discovery and computer forensic investigations often go hand in hand. The challenge for many in the legal community is how to identify what ESI (Electronically Stored Information) requires more than typical electronic…more

| Electronic Discovery, Law Practice Products & Services

Recovering Deleted Images

There are three common scenarios in which you may want to recover deleted images: 1. Images accessed from web sites 2. Images downloaded by a user or obtained through file sharing applications 3. Photos stored on a computer…more

| Electronic Discovery, Law Practice Products & Services

Encrypted Hard Drive Dangers

You have requested a hard drive clone or image and discover that the contents cannot be culled or reviewed. One reason may be hard drive encryption. Encryption involves ”scrambling” the contents of a file or hard drive so that…more

| Electronic Discovery, Law Practice Products & Services

File Carving – Valuable Remnants Recovered!

Carving files, which can be performed manually or through an automated process, permits the recovery of a portion of a corrupted or deleted file. During a computer investigation, examiners may encounter deleted files that cannot…more

| Electronic Discovery, Law Practice Products & Services

Imaging Hard Drives – Will you get what you expect?

If you or a partnering service bureau need to be able to process or review your client’s files from an imaged hard drive, you may be in for a surprise. The results of an imaged hard drive are often stored in a forensic image…more

| Electronic Discovery, Law Practice Products & Services

Understanding File Timestamps

The terms, ‘file timestamps’ and ‘file metadata’ are often used interchangeably, however, they can have two completely different meanings. I trust the following will help clarify the differences…more

| Electronic Discovery, Law Practice Products & Services

This profile may constitute attorney advertising. Prior results do not guarantee a similar outcome. Any correspondence with this profile holder does not constitute a client/attorney relationship. Neither the content on this profile nor transmissions between you and the profile holder through this profile are intended to provide legal or other advice or to create an attorney-client relationship.