Evidence Preservation vs. Forensic Analysis
Preservation protects digital evidence before substantive forensic analysis, event reconstruction, or expert evaluation begins.
Preservation Is Distinct from Analysis
Evidence Preservation
- Preservation before data is altered, deleted, overwritten, or lost through access changes or device turnover
- Documentation of preserved sources
- Documentation of verification results
- Delivery without artifact interpretation, event reconstruction, or substantive opinions concerning the evidence or matter
Forensic Analysis Under a Separate Scope
- Artifact interpretation
- Timeline and activity analysis
- Event reconstruction
- Forensic examination reports and expert testimony
Data365 maintains records of the preservation and acquisition work it performs. When appropriate, testimony concerning that work, the processes it used, and related records may be separately arranged. Expert analysis or opinions, whether provided in a report, declaration, or testimony, require separate written scope.
Separation of Preservation and Analysis
Preservation need not wait for a decision about forensic analysis. After preservation, analysis can be handled under a separate scope or by another retained examiner.
Data365 Services
- Preservation of data from devices, accounts, account exports, and system records
- Forensic data acquisition from devices and accounts
- Chain-of-custody records
- Verification records, including hash values when generated
- Transfer and delivery as directed by the authorizing party
Preservation Intake
Preservation intake records source condition, authority, access, preservation deadlines, and delivery requirements.
Boston-based, serving clients nationwide. On-site by appointment across New England, New York, Greater Philadelphia; travel elsewhere by arrangement.