Gain valuable insight through Forensic Analysis & Testing.

Analysis

A trained Forensic Analyst from Vestige will use an arsenal of over 250 tools to properly analyze the preserved Content & Artifacts to uncover any relevant digital evidence and uncover electronic “footprints” or artifacts that are left on electronic media.

Here are samples of Content & Artifacts we look at during a Digital Forensic examination:

CONTENT, such as:

• • User documents (Word, Excel, PDFs)
  • Correspondence (e-mail, instant messages/texts)
  • Web history, including searches conducted
  • Printed documents, faxed documents
  • Business records
  • Databases
  • Deleted data

ARTIFACTS, such as:

• • Software installed/uninstalled
  • Hardware attached/removed
  • Evidence of file transfers
  • Use of removable media, such as USB drives/flash drives
  • CD/DVD burning
  • Network connections (including WiFi, Cellular, etc.)
  • Remote access activity
  • Evidence of hack-in
  • Deletion activity
  • Wiping software

The Difference Between Content & Artifacts

If you’re looking to find proof from a digital device in a matter or case — it’s important to know the difference between digital CONTENT and ARTIFACTS.

Content

Mobile phones, computers, laptops, servers, surveillance systems and other digital devices are repositories of CONTENT. Content includes user documents we’re all familiar with such as: Word files, spreadsheets, emails, instant messaging, text messages, etc.

While it is true you can garner a lot of information from content – there’s a whole other world of information that exists that you may be missing – ARTIFACTS. Digital forensic artifacts are not only more interesting but most importantly can provide far more validity to proof or factual digital evidence. Here’s why…

Artifacts

Forensic artifacts are items that get left behind based upon the activities of the end user of the device – footprints if you will. However, end users are generally not aware that these artifacts exist, furthermore, unlike content, artifacts are difficult to access and manipulate. As a result, there is significantly more validity of proof by considering the artifacts.

How Digital Artifacts Are Used

1. Artifacts are used to corroborate the information in the content.
2. Artifacts can reveal things that content never will. (We’ve yet to find a case where somebody wrote a document (content) where they said, “Dear Boss, This is the stuff I’m going to steal from the organization today.” Yet – working from the artifacts, Digital Forensic Experts can tell just that.
3. Artifacts can show intent or the state-of-mind of the individual. This includes what internet searches were being conducted and what web pages were visited or researched.

Examples of digital artifacts garnered from web searches:

• •  “Wife+Murder+Electrocution”
  •  “How to frame your employer for more severance pay”
  •  “When is the best time to start a fire”
  •  “How to cover your tracks in arson”

Once we arrive upon a hypothesis we test it.

Testing

The added value that Vestige offers to clients is extensive testing of our findings. Testing the results of our analysis is tantamount to our methodologies and success.

As we analyze the evidence, our hypotheses surrounding the findings are tested using an environment as close to or the same as the source environment – this provides the truest results and adds strength to our findings.

We are able to gain remarkable insight within digital devices because we perform extensive testing before reporting results. Proper testing assures accurate, air-tight, and legally defensible opinions.

To learn how artifact analysis can assist in your case, contact Vestige today to discuss.

Vestige Analysis & Testing Solutions in the boxes below: