Data Acquisition is a bit-to-bit image copy of the provided media using accepted forensic techniques and procedures.
What does this mean?
When data is written to media, such as a computer hard drive, digital bits (zeros and ones), representing data to be stored, are written within allocated sectors on the hard drive. Byte by byte, information is stored on the hard drive per the direction of the computer system and/or its users. However, when the user or system directs that data to be deleted, outside the use of additional software or special settings, the clusters on the hard drive are merely marked for available use and the data still remains on the drive to be discovered through a forensic examination.
What does that mean to me as a customer?
Although important information possibly still resides on this media, data located within unallocated space (those areas marked available for data storage) cannot be found within the logical file system (i.e. cannot be seen from Windows or your chosen Operating System). So, data deleted by the user is not available for review or backup. Specialized software and techniques must be used to insure the fullest account of the data; both that residing in unallocated space as well as in allocated space (used space). Proper techniques and procedures insure data integrity and the usability of the information in administrative and legal proceedings. Digital Operations Group is certified in the areas of electronic evidence collection and computer forensics and has extensive experience with the rules of handling evidence. We have the expertise and equipment to image the respective media in-house or on-site.
