So we have compiled another list of tell tale signs

•          More attentive to their personal appearance.

•          Show up late, make sudden excuses about why they have to leave.  Quick trips to run errands turn into timely trips that cannot be explained, mileage on the car is high yet he / she reports only short distant errands.

•          Excuses to be away from you, usually boys or girls night out.  They act irritated if you question their whereabouts or want details of their time out.

•          Moody, bossy or show irritation towards you for no reason, they act distant, unattached to the family.  

•          Private phone calls, not answering phone in your presence, hiding cell phone statement.  

•          Discouraging you from visiting them at work, or nervous while in company of others (typically indicates lover is there)

•          Frequent ATM withdraws (look for a pattern)

The Infocus team will provide a detailed, thorough investigation and supply you with video or photographic evidence to assist you in taking the appropriate steps to resolve the issue. Infocus investigators are located throughout the state of NY which eliminates lengthy travel time.

CALL TODAY FOR A FREE CONFIDENTIAL CONSULTATION  315.573.9118

Private Detective Rochester NY, Private Investigator Rochester NY, Private detective Agency Rochester NY, private Investigator Syracuse NY, Private Investigator Finger Lakes NY, NY Private Investigator, Private Investigators Rochester, Syracuse,  Auburn, Geneva, Victor, Fairport, Finger Lakes, Central NY, Elmira, Ithaca, Hornell, Batavia, Pittsford, Webster, Naples, Canandaigua, Williamson, Henrietta, Penfield, Newark, Marion, Macedon, Farmington

We cover the entire state of NY

I think I would like to use your services, what is the next step?

Infocus offers a free, confidential, one on one consultation with a case manager. You can meet at one of our offices throughout the region, a case manager can meet at a location you are comfortable with, or details can be discussed over the phone.

 The assigned case manager, will discuss your options and answer questions you may have. We will ask relevant questions, and explain in detail the proper steps and associated fees related to your investigative needs.

 How much will the investigation cost?

Infocus, can tailor each investigation specific to your needs. In doing so, we can accommodate and work within many budgets. Infocus also offers reasonable payment plans.

How long will the investigation take?

Many investigations can be completed within a very short period of time. There are some instances where during the investigation, information was obtained which warranted further probes into the subject and resulted in extended operations.

Do I get progress reports or daily phone calls?

At Infocus we give you the options, be it daily phone updates, email, or protected username and password to our case management software.  

 Why should I use Infocus?

Every case manager is required to have a minimum 10 years of experience in the field of private investigations. Some exceed 20 years. Each and every Infocus investigator is trained here locally, and also goes through extensive training provided by National Strategies Group. We are available 24 hours a day, 7 days a week. Our investigative staff is strategically located throughout the state to minimize travel.

Some looking for an “easy out”, or an effortless source of additional income, may turn to insurance fraud as their solution.  Infocus investigators are highly trained and possess the ability to conduct discreet interviews with neighbors, friends, co-workers, and associates of a claimant in order to determine the claimant’s true status in an insurance claim.

A thorough pre-investigation in the form of an activity check is standard practice at Infocus.  This enables our investigators to craft an informed claimant profile and obtain critical information to determine if surveillance is warranted.  Additionally, it saves our clients time and money.

When surveillance is warranted, the typical insurance fraud investigation will begin, in most cases, with 1 to 2 days of surveillance to determine the claimant’s day-to-day activities.  During this period, ideally, the investigator will observe and document the claimant working or performing activities which will discredit their claim.

Each Infocus investigator is equipped with the latest technology in covert video documentation and tracking devices.  Upon conclusion of each investigation, a detailed report and video is provided to the client

CALL TODAY FOR A FREE CONSULTATION      315.573.9118

Percentage of marriages that end in divorce in America: 53%

Percentage of “arranged marriages” (where parents pick their sons or daughters spouses) that end in divorce: 3%

Medical field(s) with the highest divorce rate: psychiatrists and marriage counselors

Percentage of marriages where one or both spouses admit to infidelity, either physical or emotional: 41%

Percentage of men who admit to committing infidelity in any relationship they’ve had: 57%

Percentage of women who admit to committing infidelity in any relationship they’ve had: 54%

Percentage of men and women who admit to having an affair with a co-worker: 36%

Percentage of men and women who admit to infidelity on business trips: 36%

Percentage of men and women who admit to infidelity (emotional or physical) with a brother-in-law or sister-in-law: 17%

Average length of an affair: 2 years

Percentage of marriages that last after an affair has been admitted to or discovered: 31%

Percentage of men who say they would have an affair if they knew they would never get caught: 74%

Percentage of women who say they would have an affair if they knew they would never get caught: 68%

Private Detective Rochester NY, Private Investigator Rochester NY, Private Investigator Syracuse NY, Private Investigator Finger Lakes NY, Background Check, Surveillance, Insurance fraud investigations, Rochester NY employee theft investigator, fraud investigation,  Private Investigator Auburn Geneva Victor Fairport Central NY Elmira Ithaca  Pittsford Webster Canandaigua  Williamson Henrietta Penfield Sodus  Bloomfield  Bristol Marion

Infocus investigators are trained to conduct face-to-face interviews, under pretext, to obtain valuable information on claimants’ activities.  The activities check may provide a detailed profile of a claimant’s address, any associated vehicles, his/her employment status, as well as the findings of a neighborhood canvass.  Information obtained from these investigations can help mitigate losses on outstanding claims

Private Detective Rochester NY, Private Investigator Rochester NY, Private detective Agency Rochester NY, private Investigator Syracuse NY, Private Investigator Finger Lakes NY, Process Server, Process Service, Service of Process, Subpoena service, Witness Locates, Locate Witness, Background Check, Surveillance, Insurance fraud investigations, background checks, background investigation, criminal background check, employee surveillance, employee theft investigation, workers comp surveillance, fraud investigation, missing person investigators, child welfare investigators, Rochester, Syracuse, Auburn, Geneva, Victor, Fairport, Finger Lakes, Central NY, Elmira, Ithaca, Hornell, Batavia, Pittsford, Webster, Naples, Canandaigua, Williamson, Henrietta, Gates, Penfield, Chili, Sodus, Bloomfield, Bristol, Newark, Phelps, Clifton Springs, Marion, Macedon, Farmington

Phillip Knightley explodes a few “honey trap” myths in this article for Foreign Policy Magazine, titled: “The History of the Honey Trap.” And in this piece for the Times Online, British journalist Jon Swain describes his romance with a beautiful “Mossad Mata Hari” posing as a photojournalist.

Mostly, these anecdotes reveal a simple truth. The honey trap often comes to naught: sex or romance exchanged for useless information, if any at all; failed schemes to ensnare, compromise, and blackmail powerful men (and sometimes women).

And from the point of view of the private investigator, what’s the use of it? Considering how many of our cases have to do with domestic relationships, how would a honey trap work, exactly? The word “entrapment” immediately springs to mind.

Which leads to the point of this article: why waste a female operative’s unique skills by merely exploiting her sexuality?

“In most of the world, women in law-enforcement or security are considered non-players,” says Agent X, a 20-year veteran of the trade who has worked internationally. “It’s just a mindset. That’s why it’s often so much easier for women to do surveillance.”

Agent X points out that because such a small percentage of law-enforcement and security personnel are female, women can often disappear into the environment in ways men might not be able to. A man walking a dog in a neighborhood at night might arouse suspicion, for example. “But a woman in that situation is perceived as non-threatening,” he says. “It’s not uncommon to see a woman walking a dog or pushing a carriage…and she’s able to get closer to targets that way.”

The same goes for surveillance at a bar or restaurant. “It’s easier for a man-woman surveillance team or a single woman to sit in a bar and watch (without arousing suspicion) than for a man to sit alone,” says Agent X.

“Women just aren’t seen. They’re invisible,” he adds, at least, from the point of view of targets keeping an eye out for tails. “Because they’re not ‘classical’ authority figures.”

Agent X admits, this approach plays to the stereotypes about men’s and women’s traditional roles in society. But when it comes to surveillance, playing to stereotypes works. Would you wear a polo shirt and khakis while infiltrating a biker bar? What about a country club?

When it comes to disappearing into the background and quietly gathering information, it’s all about perception, playing to what people expect to see. “If you’re a female with a stroller, a dog, a leash, or a baby seat in your car, there’s nowhere you can’t go,” he says. “Think about it: a guy walks around looking in my yard – suspicious, right?  He’d better have on a gas company vest. But a woman out there with a leash calling a lost dog? Who’s not gonna come out and help her look for it?

“A female just has so many advantages,” says Agent X. Especially as part of a man-woman team. “If somebody’s engaged at the front door with some stupid dog story, somebody else can be in back doing a trash pickup.

“Pack a baby seat, stroller, and leash in your car,” he advises female investigators. “Then have a bag ready with a jacket, shorts, sweat pants, sneakers, pumps, and a couple of different shirts.” In two minutes, he says, a female can easily dress up or down, go into character, walk in anywhere, and fit in, from a gym to a nightclub. “Boom, you’re done,” he says. “You’re unburnable.”

And the purse-cam is rolling.

Editor’s Note: The above piece was provided courtesy of Thomas H. Humphrey via his [FIND] Investigations blog at http://findinvestigations.blogspot.com This is a GREAT blog and certainly worthy of adding it to your RSS feeds or favorites list.  I never fail to find fascinating and fun nuggets of information posted there. Check it out!

Thomas H. Humphreys lives in Nashville, TN where he shares a house, an office, and a life with his wife and partner Kim Green. Mr. Humphreys is an award winning journalist and has contributed to international travel publications, regional magazines and news papers, as well as various public radio outlets. Mr. Humphreys owns [FIND] Investigations, a full service private investigations company.

[FIND] Investigations Website
[FIND] Investigations Blog
Email Thomas

Nursing home abuses are becoming more widely discovered because some of the employees of these facilities are unsung heroes who step forward to tell the truth for what it is.  The “whistle-blowers” law has aided in these individuals coming forward because the facilities cannot legally retaliate against an employee who “blows the whistle” on their employer.  During our investigations, we find that many of these employees have worked at all of the nursing homes in the area because they keep trying to find one that isn’t as bad as the one they just left.  After seeing the neglect and abuse at a nursing home, their conscious can’t take it any longer and they decide to move on to another facility.

Unfortunately, this is an industry-wide problem that stems from the owners of nursing homes trying to drain every penny of profit out of the operation.  When this occurs, the focus changes from how good of care they can give to the patient to simply keeping the home running without any major problems.  In their quest for profit, the owners pay their staff slightly above minimum wages and the LVN’s and RN’s receive a lower pay than their counter-parts at hospitals.  Obviously, if these people are getting paid less than others in the same field, they will eventually develop poor attitudes and moral will be low.  Instead of paying a higher wage and getting a better trained and qualified employee to begin with, the industry keeps on with the poor standards.  People need jobs, and because they need jobs, the nursing homes will always get people who will work for the pay they provide.  That doesn’t make it right.

One day, the nursing home industry will realize that they are starting to pay more for lawsuits and bad publicity and will understand a simple principal of business.  If they would simply pay their employees better, they would attract a better quality of person who is better trained.   If they can hire a better trained person who is making a pay level more in line with their counter-parts, their moral will be better, work will get done, the patients will be better treated and the nursing homes will not get sued.  It simply comes down to the fact that they can pay more money up front or pay a lot more money when they are sued.  None of the facilities seem to have caught on to this simple fact.

The general public is getting smarter and more concerned about this type of abuse and is starting to place hidden video cameras in their family’s rooms to catch the abuse.  As the public gets better educated, there will be more eyes paying attention which will in turn create more opportunities for lawsuits.  Almost everyone has heard about “lawsuit abuse,” and I don’t think anyone is jumping for joy by the thought of more lawsuits, but this is the remedy set aside for seeking relief for neglect and abuse.  The way to stop the lawsuits is to simply stop the abuse.  The way to stop the abuse is for the nursing home industry to truly police themselves.

No one likes the idea of having their mother or father treated in this fashion, and I can assure you that this is going to be more concern as the “baby-boomer” generation gets older and we have more elderly that are going to have to be dealt with.  The nursing home industry actually has the opportunity to make a great deal more money in the near future because of this.  However, people will begin to take relatives in more or find some other manner in which to make their parent’s last days more respectable and comfortable if the industry continues on their current course.

The State agencies that regulate the facilities are just as much to blame for this dilemma as anyone.  Their job is to properly license and police the facilities.  Of course, the first thing you hear from them is that they don’t have enough staff or money and they are doing everything they can.  Unfortunately, neither is true.  For the most part, all government agencies have more money than they need because the government’s solution to any problem is to throw more money at it.  I have yet to find a nursing home that did not know in advance that they were going to have an inspection by the State.  When the nursing homes know ahead of time, they begin to fill in charts, put out new linen that is just there until the State leaves and reschedule employees so that there appears to be more on duty when the State is there than normal shifts.  In essence, it is like a child getting told that the parents are coming upstairs to inspect their room in an hour and giving them enough time to push things under the bed and hide things out of sight.

There is going to have to be a more aggressive approach to regulating the industry.  I don’t mean more laws.  We have plenty of laws, rules and restrictions.  What we need is someone who has enough desire and will-power to actually make truly unannounced inspections and hand out fines that will get the attention of the administrators.  Some of the ways to over-come poor inspection habits are as follows:

• Make inspections more than once a year
• Make the inspections at a time that does not coincide with the renewal of a facility’s license.  They all know they have an inspection coming right before they are re-licensed.
• Create inspection “teams” consisting of more than one inspector.  Even when the inspector arrives, word spreads through the home that an inspector is there and the other end of the facility has time to get their act together before the inspector can make it all the way to them.  By sending at least two inspectors, one can start at one end and one at the other and cover more ground.
• Stiff fines need to be assessed for violations.  The nursing home administrators understand money and that will get their attention.
• Post the inspections grades on the State’s Internet sight for the world to see.  By doing this, you create bad publicity for those messing up and creates an incentive to change.
• Make sure that the inspectors have not worked at the nursing homes that they are inspecting as they form friendships that will not be broken.  Many of the State inspectors worked in nursing homes before they went to work for the State and they still have contacts there.
• Increase the number of inspectors to a workable ratio between homes and inspectors
• Set guidelines for the inspectors requiring a certain number of inspections per week.
• Enact ordinances allowing nursing home records to be made available to public under the open records act.
• Require the financial statements of the nursing home facilities to be made public since public funds often pay for the patients and their treatment.

By enacting some or all of these suggestions, the industry will begin to see an improvement.  Failing to do so will keep the facilities operating in a “business as usual” status which clearly is not working.

Kelly Riddle is the principal of Kelmar and Associates, formed in 1989, and conducts investigations domestically and internationally. A distinguished speaker and author of 10 books, Mr. Riddle has more than 30 years of investigative experience and earned a Bachelor of Science degree in Criminal Justice from the University of North Alabama. He was chosen as the “PI of the Year” by the National Association of Investigative Specialists and the PI Magazine named Mr. Riddle as the “#1 PI in the United States”. He has been designated an expert in surveillance, insurance investigations, nursing home abuse and computer investigations. He was chosen as “One of the Top 25 PI’s of the 20th Century.” Kelly obtained his Texas Certified Investigator designation (less than 50 in TX.) Mr. Riddle is also on the Board of Directors for the Texas Association of Licensed Investigators (TALI).

$20 Dollar IRBStore.com Coupon Offer Below!

There are hundreds of different types of digital audio recorders available on the market today and it is important that you know exactly what features to look for when making a purchasing decision.  The Sleuth Gear Digital Recorder with Micro SD Expansion Slot was designed specifically with the needs of private investigators in mind.  This digital recorder has 1 GB of internal memory built in that can record up to 65 hours of audio.  Use the SD expansion slot with a 2GB or 4GB memory card and you can get between 260 and 325 hours of recording.

Because there are no cassette tapes to lose, buy or run out of, your recordings can easily be uploaded into your computer as an .mp3 or .wav file.  Once the recording as been uploaded to a computer, the possibilities are limitless.  If you are in the field, the recordings can be easily transferred to another device, making the information in your investigation up-to-date and easily accessible.

The Sleuth Gear Digital Recorder records in different quality modes to save space and battery power.  It is also one of the few digital recorders on the market that can record in stereo CD quality.  You will never miss another piece of valuable information because of poor recording!

The Sleuth Gear Digital Recorder is also unique to investigators because it comes with adapters to record cell phone and telephone conversations.  The cell phone adapter on this recorder is actually a microphone that picks up both sides of the conversation and adapts to any cell phone, including the new smart phones such as the BlackBerry, Android phones and the iPhone!

The Sleuth Gear Digital Recorder can be set to voice activation; if you are driving or unable to access the buttons, simply speak into it and it will begin recording until you stop talking.  The voice activation feature and discreet size, make it a perfect tool for covert operations, too.

This digital recorder comes with several accessories designed specifically with the private investigator in mind.

They include:

• Cell phone adapter
• CD ROM
• AAA batteries
• Audio Cable
• External Microphone
• USB Cable
• Headphones
• Phone recording adapter
• User’s manual
• AC Adaptor

You will not find another digital recorder on the market that has all of the features and accessories of the Sleuth Gear Digital Recorder.

Purchase the Sleuth Gear Digital Recorder from IRBstore.com now through April 23rd 2010, and receive $20 off! Use coupon code digital20 to instantly receive the discount before this coupon expires!

Click on the link to go directly to the Sleuth Gear Digital Recorder

Please visit http://IRBstore.com for more products!

Washington, D.C. March 23, 2010 – With the growing cost of cybercrime, Senators Orrin Hatch (R-UT) and Kirsten Gillibrand (D-NY) introduced the International Cybercrime Reporting and Cooperation Act, new bipartisan legislation that would enhance U.S. cooperation with other countries to confront this threat and keep America safe.

“Cybercrime is a serious threat to the security of the global economy, which is why we need to coordinate our fight worldwide. Until countries begin to take the necessary steps to fight criminals within their borders, cybercrime havens will continue to flourish,” said Senator Hatch. “We don’t have the luxury to sit back and do nothing. I believe the International Cybercrime Reporting and Cooperation Act will not only function as a deterrent of cybercrime, but will prove to be an essential tool necessary to keep the Internet open for business.”

“Cybercrime must be a top priority for our national security,” Senator Gillibrand said. “If we’re going to protect our networks, our infrastructure, our economy and our families, we have to go after cyber criminals wherever they may be – and it must be an international effort. Our new legislation will require the president to provide a global assessment, identify threats from abroad, work with other countries to crack down on their own cyber criminals, and urge the President to cut off U.S. assistance and resources for countries that refuse to take responsibility for cybersecurity. Our legislation will make America safer by getting tough on cybercrime globally, and coordinating with our partners in the international community.”

For more than a decade, reports have described the increasing vulnerability of the U.S. to cyberattacks. A growing array of international criminal organization are targeting American citizens, commerce, and information infrastructure, including the Internet, telecommunications networks, financial systems, embedded processors and controllers in critical industries to steal, exploit, disrupt, or destroy information.

An estimate from the Government Accountability Office (GAO) estimates that in 2005 U.S. businesses lost $67.2 billion as a result of cyberattacks. Since then, attacks have dramatically increased. Earlier this year, hackers in China launched a large, sophisticated attack on Google and other American businesses. The global economy overall lost over $1 trillion in 2008 as a result of cyber attacks, according to studies by McAfee, Inc.

Numerous American employers, including Cisco, HP, Microsoft, Symantec, PayPal, eBay, McAfee, American Express, Mastercard and Visa, as well as Facebook, are supporting the Senators’ legislation.  “Microsoft strongly supports the International Cybercrime Reporting and Cooperation Act and applauds Senators Gillibrand and Hatch for their leadership in this area,” said Fred Humphries, Managing Director of US Government Affairs, Microsoft Corp. “This legislation is a great step forward toward accessing the technology capabilities and judicial remedies of foreign countries to combat cybercrime and provide a safer, more trusted and secure Internet.”

“We support efforts to increase global awareness of cybersecurity issues, and to improve cybersecurity and investigations of cybercrime,” said Tucker Foote, Vice President & Head of U.S. Government Affairs, MasterCard Worldwide. “We believe your legislation provides useful tools to further those goals and to provide a safer environment for U.S. consumers and businesses to operate in today’s technology-driven world.”

Criminals are increasingly going after online financial data – costing businesses and individuals billions. In fact, each data breach costs American businesses an average of $6.6 million.
Cyber exploitation activity has grown more sophisticated and targeted over the past year and is expected to increase. Relevant international cybercrime agreements have not been signed by certain key countries that host cyber criminals with apparent impunity.

To boost America’s cybersecurity, improve our coordination with allies, and establish tough new ways to crack down on cyber threats internationally, Senators Gillibrand and Hatch today introduced the International Cybercrime Reporting and Cooperation Act.

Annual Presidential Report
The bill would require the President annually report to Congress on the assessment of the state of countries’ use of information and communications technologies (ICT) in critical infrastructure, the extent and nature of cybercrime based in each country, the adequacy and effectiveness of each country’s legal and law enforcement systems addressing cybercrime, and countries’ protection of consumers and commerce online. The President would also report on multilateral efforts to prevent and investigate cybercrime, including U.S. actions to promote such multilateral efforts.

Deliver Foreign Assistance to Prevent Cybercrime Havens
The bill would require that programs designed to combat cybercrime be prioritized to countries with low ICT penetration in order to prevent such countries from becoming future cybercrime havens. Also, U.S. or multilateral assistance designed to improve critical sectors such as finance or telecommunications would be encouraged to include programs designed to combat cybercrime in order to ensure that such assistance is not inadvertently being used to build future crime havens.

Identify Countries of Cyber Concern
The bill would require the President to identify countries of cyber concern – those for there is significant credible evidence that a pattern of cybercrime against the U.S. Government, private entities or persons by persons from within such countries’ borders and such countries do not sufficiently address cybercrime through investigations, prosecutions, bilateral or international cooperation, or appropriate legislation or similar measures.

For each country of cyber concern, the President would establish an action plan with benchmarks designed to assist the government of each such country to improve its capacity to combat cybercrime. This plan would be developed and carried out in consultation with the county of concern in order to encourage them to reach the benchmarks. The President would provide an annual assessment of the country’s participation in the action plan.

The President could waive the requirement to develop an action plan for any country if it is in the national interest, and report such waiver to Congress, in classified form if necessary.

Failure to Meet Action Plan Benchmarks
Countries of cyber concern that do not reach their benchmarks may have one of the following benefits suspended, restricted or prohibited: new OPIC or ExIm financing, new multilateral financing, new TDA assistance, preferential trade programs, or new foreign assistance, as long as such do not limit projects to combat cybercrime.

Department of State International Cybercrime Policy Focus In order to improve the U.S. focus on addressing international cybercrime, the bill would require the Secretary of State to designate a senior official at the State Department to coordinate and focus on activities, policies and opportunities to combat cybercrime internationally, and in consultation with other Federal agencies and the relevant chiefs of mission, appoint employees at key embassies to focus on cybercrime policy.

This brief was provided courtesy of the Investigative & Security Professionals for Legislative Action (ISPLA).  The mission of ISPLA is to monitor and identify critical legislative and regulatory issues in order to provide a forum for debate and discussion within the investigative and security professions and to serve as an advocate for these professions.  To support and join us in this mission go to www.ISPLA.org

Bruce Hulme
Director of Government Affairs

Perhaps becoming more than simply obvious, the search for digital evidence may have become a minimum professional standard of client representation.  Chief Judge of the United States District Court for the Southern District of New York, Judge Loretta Preska, “responding to a question once explained that it is ‘hard to say’ whether an attorney’s failure to seek electronic discovery in a case could support a finding of legal malpractice.  ‘The rules talk about the production of relevant information,” she said, “so we seem to create the burden to seek e-data.”  While noting that the increase cost associated with electronic discovery ‘have changed the game,’ she added that she can’t image how counsel who is responsible cannot seek relevant electronic information.” (Dorrian, Patrick F. “Jurists Offer Perspective, Tips on Electronic Discovery”.  Metropolitan Corporate Counsel, Nov. 2003)

Digital evidence is being employed effectively in all types of litigation.  From hostile work environment issues, criminal defense cases, intellectual property matters, financial fraud to family law practices, very few matters of litigation could not benefit from the services of a digital forensics examiner.  Today, the question of discovery has evolved from, “Is electronically-stored information available?” to, “What probative digital information is available and how do I collect that information in a way that will meet the standards of admissibility?”

Electronic Discovery and Digital Forensics

Electronic discovery, more commonly referred to as e-Discovery, is the gathering, analysis and production of electronic documents in litigation discovery. Beyond word processor and spreadsheet files, electronic documents typically also include e-mails, their attachments, website information and other data stored on a computer, network, backup or other storage media.  In e-Discovery, the information collected usually only includes active and archived data that is easily accessed and has not been deleted, encrypted or hidden.  Typical data repositories include back-up disks or tapes, email servers and network server storage.  In e-Discovery data is accessed, but not analyzed.

The commonly accepted definition of digital forensics is “The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of evidence derived from digital sources.”  More plainly, digital forensics is the art and science of finding, analyzing, preserving and the precise documentation of digital evidence, wherever it may be found, and then interpreting those findings in a way that makes it meaningful to any client or trier of fact.  It is a science in the sense that a digital forensic examiner’s approach uses the investigative method as well as certain industry-recognized protocols and standards.  It is also called an art because each examination involves the skills, techniques and abilities of the examiner to find the deleted and hidden files or other bits of information that would surely be missed through e-Discovery; every examination is unique (although each should produce the same results). An even simpler definition might simply be summed up this way, “Digital forensics is the transformation of raw data into intelligible information that meets the minimum standards of legal admissibility.”

The most important concept to understand is that the goal of every forensic examination is to produce “forensically sound” evidence.  The key to a sound examination hinges on the exact duplication of the evidence being collected; this insures there are no changes to the original evidence and there is no rule more important than preserving the original source of the collected data.  If the examiner makes a mistake during the imaging process and alters the source in any way, the forensic review must come to a halt and that source of data is lost forever.  Something as simple as turning a device off or connecting a USB to a computer virtually guarantees the corruption of any potential evidentiary value of the digital contents.

Forensic imaging, or copying, involves the following critical phases:

• Securing and preserving the data source;
• Imaging the items;
• Documenting the approach and methods used to copy data;
• Validating the accuracy of the evidence.

The essence of computer forensics begins with the procedures utilized to create a forensic image.  A proper forensic imaging process insures the integrity of the evidence by preserving it.

Digital Evidence

Forensic examiners typically target a specific personal computer, hard drive or other storage devices and mediums searching for and restoring deleted and hidden information.  Typical sources of digital evidence include personal computers, mobile communication devices (smart phones and mobile cellular telephones) and digital storage mediums including tape, floppy discs, compact discs, digital video discs, external or network hard drives, flash memory cards and USB “thumb” drives. Increasingly, digital forensic examiners are beginning to specialize in extracting data from often overlooked digital sources such as digital cameras, images and photographs, computer peripherals (printers, fax machines, scanners and copiers) as well as satellite navigation devices, automobile “black boxes” and web pages.  In fact, anything with a memory chip installed in it might store critical evidence!

Digital evidence comes in many forms depending upon its source.  Computers will generally produce the following types of information:

• Hidden, deleted, temporary and password-protected files can be recovered
• Documents and spreadsheets
• Contact information and calendars
• Email
• Internet browsing history and habits
• Pictures, graphics, videos and music
• Event logs, hacker activity and break-in attempts
• Software installed (illicit, pirated and legitimate)

Similarly, a wide range of information can be extracted from a mobile communication device:

• Hidden, deleted, temporary and password-protected files can be recovered
• Phone number and service provider information
• Outbound and inbound call information
• Text messages, instant messages and email
• Address nooks and calendars
• Global positioning system data and location information
• Internet browsing history and habits
• Photos, videos, music and voice recorder data
• Predictive dialing directories and dictionaries
• Ring tones

Files types and data often not considered or are overlooked altogether:

• Spooler files – cached files sent to a printer
• Virtual memory – memory that is transferred to a hard drive when a PC is running low
• Temporary Internet files – where browsers load images and information about web pages
• Automatic backup files – where document data is stored to insure against loss in the event of a power failure or operating system crash.
• Recent link or used document files – the file path to documents and websites most recently visited.
• Power saver files – Used especially by laptop computers before running out of battery power.
• Metadata – In general, data about data is referred to as metadata.  In this case, metadata refers to additional information about the questioned documents or images, which is stored as a part of the entire document file. The metadata can contain the history of the document, including all users who have modified or saved it, names of printers it was printed upon, etc.

The Digital Forensic Examiner

The foundation of digital forensic examination rests on the following questions:

• What is the evidence?
• Where is it stored?
• How is it stored?
• How long will it be there?
• How can it be forensically imaged?
• How can that data be translated into intelligible information

The work of the digital forensic examiner falls into three broad categories:

First and foremost comes forensic imaging.  There are specific tools for acquiring forensic images of digital storage media without changing the contents.  It is not acceptable to merely copy and paste data files; the entire disk must be copied bit for bit.

Second, digital forensics incorporate established protocols for identifying and preserving digital files. The standard involves applying numeric procedures to the disk to produce a number, called a hash that is for all purposes unique to the disk. Digital forensic experts use and validate these techniques each time they access the data to demonstrate its veracity.

The third task of the forensic examiner is to interpret hidden, deleted, partial and temporary files. This analysis requires specific knowledge of how digital devices and the various software applications handle the storage of data. The specialist must be able to clearly explain his findings to the Court.

A computer forensic expert should be trained specifically in the type of media with which he or she is working.  He or she should able to assist the litigation team by helping to identify which targets will yield significant probative evidence, provide physical oversight during the seizure of evidence, recover and analyze information using peer-reviewed, industry standard techniques, software and equipment, prepare documentation in anticipation of litigation and then present testimony as an expert witness.  When choosing a digital forensics examiner look for service providers with professional certifications from forensic software developers such as enCase and FTK software and through such organizations as the High Technology Crime Investigation Association, International Society of Forensic Computer Examiners, Association of Information Technology Professionals and the Computer Technology Investigators Network.

Conclusion

There is so much more that can be written and learned about the application of digital forensics to almost any type or manner of litigation, in fact entire encyclopedias including dozen of topic-specific volumes of information have been created about this new and still maturing facet of e-Discovery.  In a world of technology that is evolving faster than any one person can keep up, one thing remains certain… digital forensics is more than undeleting deleted files and recovering deleted e-mails.  Electronic discovery presents numerous litigation management issues that should be addressed before legal action commences and must be done in concert with a competent digital forensic examiner who can address the likely scope and framework of an e-Discovery request.  Digital forensic examination, as a function of e-Discovery, will only be become more important as technology marches steadily forward.