Collection

After a project scope has been developed and all key personnel have been chosen, our forensic specialists image all necessary custodian data. Ignited has extensive on-site data collection capabilities, so whether the information lies on personal computers, laptops, or even live servers, we are able to safely capture any and all relevant information. Our examiners have acquired thousands of discoverable systems on media spanning hundreds of terabytes in size amongst thousands of custodians. Most importantly, all collections are performed using validated hardware, software and methodologies that are fully defensible in court, eliminating any unexpected surprises.

Proper forensic imaging is an absolute must in order to avoid spoliation and maintain the integrity of all data collected. Accidental modification of metadata, such as updating date and author fields, could not only cause problems in court, but also hinder the efficiency of the overall discovery process. Our team is prepared with the tools to ensure that there is minimal, if any, downtime for your clients. Improperly-performed collections could also increase the cost of litigation by requiring the re-imaging of data, having specialists recover or extract missing information, or extending costly review time because of poorly culled data. Having a 3rd party perform your collection not only mitigates the risk of IT personnel having to take stand in court, but it draws less scrutiny in court. Our team works to ensure maximum security and confidentiality for your data. Collection Strategy Travel on-site and image individual computers and servers Perform bit copies of hard disks to preserve potentially recoverable data lying in free space Collect information from live servers, maintaining maximum uptime Restore data from standard and archaic tape formats and also a variety of handheld devices Selectively pull or pre-filter data from sources Maintain full chain of custody while handling any data Process of imaging occurs without booting the machines, therefore it is a perfect snapshot of the drive as it came from client and ensures nothing was altered
Since it is not always necessary to forensically image all media, our examiners are frequently required to analyze the infrastructure where data of evidentiary value may reside and with the support of counsel, determine what data is required for collection. All examiners have years of experience handling forensic matters, are trained continually as technologies change and stay active at forensic conferences and organizations such as HTCIA. We understand that your business up-time is critical and the utmost care is considered when handling client hardware. Our team will be in-and-out in the least amount of time possible to properly collect the required data.