Hard Drive and Solid State Storage Forensics for Litigation

What a Disk Examination Can Establish

A computer drive holds documents, email, browser records, application databases and the traces of every file that was created, opened, moved or deleted. A disk examination connects those artifacts to a defined question, whether information was copied, when a document changed, which account touched a file or whether deleted material can still be read, and Global Digital Forensics scopes the work around the matter, the available devices and the relevant period rather than around a generic checklist.

Who created or used a file is a separate question from where it sits. Shared accounts, cloud synchronization, automated processes and restored backups all shape the record, so the examination separates what we observed from what we infer and tests each explanation against the other sources. That discipline is what protects the client when the findings are challenged.

Drive Examiners Who Have Been Deposed and Cross Examined

Global Digital Forensics has served law firms and companies since 1992. Robert Knudsen, a Certified Computer Examiner and CISSP on our team, has conducted hundreds of computer and mobile device examinations supporting matters in federal and state courts across the United States, and our founder Joseph Caruso, a CISSP and Certified Forensic Examiner, has examined source code, databases and transaction systems in class actions and served as a consulting expert in patent litigation. Our examiners have been accepted by courts, deposed and cross examined, and every drive image we produce is prepared with that scrutiny in mind.

That experience shows up in small decisions: whether to image a running encrypted laptop live or offline, whether a RAID member can be read without its controller, whether a solid state drive has already discarded the blocks you hoped to recover. We make those calls on the evidence in front of us and record the reasoning so another qualified examiner can follow it.

Read each examiner's credentials and court designations before engaging, then ask who would handle your drive.

Define the Question Before the Drive Is Collected

Before collection we settle which files, accounts, dates and business events matter, whether the concern is copying, deletion, external transfer, document alteration or unauthorized access, whether the original computer, removable drives, backups and encryption keys are available, whether anyone has continued using, repaired, reinstalled or reset the device, and what authority permits access along with the limits that apply to unrelated or privileged material.

Those answers decide whether a full forensic image, a targeted acquisition or an alternative source is the right approach. A request to find one email calls for a different plan from reconstructing months of employee activity, and choosing wrong at the start leaves gaps that cannot be filled once the drive has changed.

Hard Disks, Solid State Drives, RAID and Removable Media

The sources we image include desktop and laptop drives, server storage, USB media, external disks and storage arrays. The device model, the file system, the encryption, the physical condition and the acquisition method all govern what can be obtained, and RAID and network storage require controller information and a coordinated collection plan so the stripes reassemble correctly.

Deleted data does not always survive. On magnetic media, deleted content often remains until it is overwritten, while on a solid state drive TRIM, garbage collection, encryption and continued use can erase it on the drive's own schedule, and a damaged drive may need specialist handling before it can be read at all. We assess recovery potential from the actual source and tell you the realistic odds before any work begins.

If the drive is damaged or solid state, tell us the make and the symptoms before it is powered again, and we will say whether specialist handling comes first.

Tell Us About the Drive Before Anyone Powers It On

Describe the drive, its condition, what has already been done to it and the question you need answered, and a senior examiner will plan the imaging, the examination and the report with you. The initial consultation is free, and the 24/7 hotline is (800) 868-8189.

Get a Free Consultation

How We Take a Drive From Intake to Examination

At intake we record the device identifiers, the condition, every custody transfer and the authorized scope. We then plan the acquisition, selecting the method that preserves the relevant evidence and accounts for encryption, live system needs and technical constraints, and wherever feasible we acquire through a hardware write blocker so the original is never written to.

Every acquisition is verified. We record the acquisition details and the hash values appropriate to the method and retain the original and the working copies under the agreed handling plan. Analysis then examines files, metadata, application records and activity traces, correlating timestamps and validating the material findings against other available sources, and the report explains the supported findings, the unanswered questions, the methods and the limitations in language counsel can use.

Want to see what the acquisition and analysis record looks like before you ship a drive? Ask a senior examiner to walk through it on the first call.

What the Report and the Handoff Include

We agree on the required work product before analysis begins. The technical report describes the sources received, the acquisition method, the integrity checks, the custody record, the relevant artifacts and the reasoning behind each conclusion, and the retaining attorney may also receive exhibits, a chronology, native files or a review ready export, with production identifiers and load file requirements specified separately.

The report distinguishes material that was not found from material that could not be collected, because neither absence proves that an event did not happen. Storage duration, return of devices and disposition of working copies are settled in the engagement plan rather than left to assumption.

Tell us the report format your court or client expects and the return date for the device, and we will put both in the written scope.

Before You Send Us a Drive

Leave the drive as it is, with its files unopened and its software untouched. If the device is running, ask for handling instructions before changing its power or network state, because volatile information and encryption access can be lost in that moment. Note the condition of the device and who has handled it, then contact us with the device type, the relevant dates and the deadline, without uploading evidence or credentials through the inquiry form.

Related Drive Services

Explore computer and hard drive forensics scope and deliverables