Examination or Data Discovery / Retrieval, is the process by which all information
held on a computer or media is retrieved in order to aid an investigation. The term
‘computer’ in this context includes all computer media (for example: floppy diskettes,
tapes, CD-ROMs, DVDs, and removable hard drives).
Cyber Agents, Inc. can examine almost any computer regardless of operating system.
Examining a computer to discover exactly what data is stored on it, is a time consuming
and painstaking process. It is important that the examination can be proved to have
been performed thoroughly and in accordance with accepted "best evidence"
procedures and practices. Failure to do so could render any evidence of computer fraud
or abuse unusable in subsequent proceedings.
The first principle of computer examination is to ensure that the "original" computer is not
altered by any of the examination processes. Additionally, it is necessary to treat target
computers with great caution. They could contain viruses or logic bombs (booby traps)
which alter the data contained on the hard disk.