Evidence Preservation vs. Forensic Analysis
Preservation protects digital evidence before substantive forensic analysis, event reconstruction, or expert evaluation begins.
Preservation Is Distinct from Analysis
Evidence Preservation
- Preservation before data is altered, deleted, overwritten, or lost through access changes or device turnover
- Documentation of preserved sources
- Documentation of verification results
- Delivery without artifact interpretation, event reconstruction, or substantive opinions concerning the evidence or matter
Forensic Analysis by a Separately Retained Examiner
- Artifact interpretation
- Timeline and activity analysis
- Event reconstruction
- Forensic examination reports and expert testimony
A written factual declaration or limited written technical opinion may address the selected method and the preservation or acquisition performed. Such a declaration or opinion does not include substantive forensic analysis. Data365 does not voluntarily participate in depositions, hearings, or trials.
Separation of Preservation and Analysis
Preservation need not wait for a decision about forensic analysis. The authorizing party may retain a forensic examiner after preservation.
Data365 Services
- Preservation of data from devices, accounts, account exports, and system records
- Forensic data acquisition from devices and accounts
- Chain-of-custody records
- Verification records, including hash values when generated
- Transfer and delivery as directed by the authorizing party
Preservation Intake
Preservation intake records source condition, authority, access, preservation deadlines, and delivery requirements.
Boston-based, serving clients nationwide. On-site by appointment across New England, New York, Greater Philadelphia; travel elsewhere by arrangement.