What to know before a digital forensic examination.
Digital evidence can be time-sensitive. Early consultation can help identify preservation issues, define the right forensic question, and reduce the risk of potentially relevant data being changed or lost.
Start with the question, not the software.
Every matter is different. The device, data source, timeline, legal issue, and condition of the evidence all affect what can be examined and what approach makes sense.
Discuss Your MatterWhat types of matters does First State Forensics handle?
Services include mobile and computer forensics, civil litigation support, independent forensic review, supplemental agency support, data recovery, cryptocurrency intelligence, OSINT-related analysis, training, and technical consultation.
When should I contact a forensic examiner?
As early as practical. Digital evidence can change, be overwritten, synchronize, expire, or become unavailable. Early consultation helps identify what should be preserved and what actions should be avoided before an examination begins.
Do you examine iPhones and Android devices?
Yes. Mobile-device work may include forensic acquisition and review of application artifacts, communications, media, metadata, browser activity, account information, location-related artifacts, usage information, and deleted data where technically recoverable.
Do you examine computers and storage media?
Yes. Examinations may involve Windows and macOS computers, hard drives, SSDs, USB devices, memory cards, external media, and other supported storage sources. Analysis can include file-system artifacts, user activity, applications, internet history, metadata, deleted files, and timeline reconstruction.
Can deleted data be recovered?
Sometimes. Recovery depends on the device, operating system, application, storage technology, encryption, elapsed time, subsequent device use, and how the evidence has been handled. Deleted-data recovery should be evaluated case by case rather than guaranteed in advance.
Can you review an existing forensic extraction or report?
Yes. Independent review can include examination of existing forensic exports, reports, underlying artifacts, databases, metadata, timelines, and methodology to help counsel or investigators understand the findings, identify gaps, or determine whether additional examination is warranted.
How are forensic findings validated?
Findings are evaluated using appropriate forensic methodology and, when necessary, corroborated through multiple tools, raw artifacts, databases, logs, metadata, and other underlying data rather than relying solely on a single software-generated report.
What forensic tools do you use?
The examination method is selected based on the evidence and the question being asked. Experience includes established commercial and specialized platforms such as Cellebrite, Magnet AXIOM and GrayKey, FTK, Autopsy, Paraben, Wireshark, Volatility, KAPE, Maltego, Shodan, and supporting forensic utilities.
What should I preserve before contacting a forensic examiner?
Avoid deleting, resetting, updating, wiping, or unnecessarily using potentially relevant devices or accounts. Preserve the original device or media when possible, document who has handled it, and contact a forensic examiner before making changes that could alter evidence.
What happens during an initial consultation?
The initial discussion focuses on the question you are trying to answer, the devices or data sources involved, relevant dates, preservation concerns, deadlines, and the scope of work. Sensitive evidence, passwords, privileged material, and large files should not be sent through the website contact form.
Where does First State Forensics provide services?
First State Forensics serves Delaware, the Maryland and Virginia Eastern Shore, Pennsylvania, and New Jersey. Remote consultation and review may also be appropriate depending on the matter and the evidence involved.