Metadata Matters
By Bob Mehr, Sr. Legal Services Advisor and John Ahearne, Forensic Analyst

Data Integrity Matters
If data is going to be used in a legal matter as electronic evidence, that means the integrity and authenticity of that data is important. Whether extracting digital evidence from a functioning or failed device, the process may make or break a legal case.
Analysis
When data is needed for legal purposes as digital evidence, we recommend that the entire digital volume of the device be preserved as a forensic image. A forensic image allows a trained forensic examiner to search every sector of the drive when looking for data or operating system information for an investigation or legal matter.
Forensic Analysis is performed using a method that is repeatable and defensible. Equally important, the examination does not alter the data in any way. Examples of when a forensic examination is appropriate include a human resources (HR) examination of an ex-employee’s computer, a divorce or a child custody case.
Other Legal Matters
In many legal situations, the examination process may never be required.
Data recovery may be needed from a device that contains one or more documents, photos or other data that may be used as part of an investigation or a lawsuit. One common example involves a failed computer or phone that has a picture of an injury or accident. The picture metadata needs to be preserved and, separately, the picture is exported so that a non-technical person or lawyer can see and use it for an investigation or lawsuit.
While the recovered photo may be sufficient initially, a forensic image is necessary to preserve the integrity of the data in the event that its authenticity is questioned or an examination of the data is needed.
Forensic Image Data Recovery Service
DriveSavers has been performing data recoveries for over thirty years. During that time, we have seen a significant increase in a need for recovered digital evidence. This increase has caused us to develop new service options, including our Forensic Image Data Recovery service.
During the Forensic Image Data Recovery process, each step is documented and a chain of custody of the device is maintained.
The Forensic Image Data Recovery service works as follows:
Forensic Image
DriveSavers specializes in resurrecting physically failed drives, smartphones and other devices, whether it is to recover family photos or digital evidence for use in an investigation. Our Certified ISO Class 5 Cleanroom, industry-leading techniques and proprietary processes provide the highest probability of data recovery success and the best possible image of the device.
Once the physical issues have been overcome, a sector-by-sector forensic image of the device is created using specialized tools. This forensic image contains all files and folders, unallocated space (deleted data and unused sectors of the device) and the operating system. Most importantly, the forensic imaging process maintains the metadata and does not alter the data.
Data Recovery
Once a forensic image is pulled from a hard drive, smartphone or other device, useable data can be extracted from the image and provided to the customer in its original format. Useable data may include Word documents, photos, videos and other data. Our goal is to provide the recovered files and folders in their original structure format, i.e. Word doc., jpeg, video, etc.
Formal Reporting or Testimony
In the event that the exported data or the forensic image is called into question, DriveSavers is prepared to back up our work with formal reporting and testimony. As noted above, the entire recovery process is documented and the data is preserved and exported using industry standard, repeatable and defensible methods.
Protecting the Integrity of Digital Evidence.
DriveSavers Forensic Image Data Recovery service is a continuation and evolution of our data recovery options. This service provides our customers with protections that they may not have known were important.
DriveSavers has been performing data recoveries for over thirty years and providing forensic images for law enforcement, law firms, forensic and eDiscovery companies for over ten years. DriveSavers is committed to providing the highest quality and most secure data recovery services.
When the integrity of the data matters, there is no substitute for experience.
Learn more about DriveSavers Forensic Image Data Recovery service.
