Onsite Collection and Data Restoration Services
Disparate data types (e.g., IM, unified messaging, proprietary databases, etc.) and encrypted data are only a few of the complex data formats encountered during collection. In many instances, internal IT and security professionals are not trained on forensic best practices and their data handling protocols may not withstand judicial scrutiny. With this service Clearwell defines a defensible data collection strategy and helps customers collect data from various data sources using forensic best practices for authentication and chain of custody. This includes creating bit for bit mirror images for investigations, decrypting encrypted files, restoring back-up tapes, and preserving ESI in a secure storage device. Once ESI is processed and collected, a processing copy is made for seamless processing, analysis, and review using Clearwell.
Benefits
- Develops and utilizes a defensible collection strategy to ensure that only the correct data will be processed by Clearwell for analysis and review
- Drives down costs and reduces review time using selective processes
- Leverages a neutral third party to provide confidence that the collection and preservation process will successfully meet any judicial challenges
Service Components
The standard offerings are listed below and can be customized where applicable
Strategy Definition:
Our experts will leverage extensive experience to help define a defensible and cost effective collection strategy
Forensically Sound Data Collection:
Collection of active files using defensible authentication and chain of custody protocols
Data Restoration:
Restoration of backup tapes and legacy media
Data Imaging:
Forensic imaging with selective export of both active and formerly deleted files
Data Decryption:
Identification and decryption of encrypted and password protected files
Data Pre-Processing:
As needed, pre-processing is available to deNIST collected data, remove system files and organize the data for processing, analysis, and review.
