Forensic Export of Data Set

On demand and preferably using a forensic copy (image file) as source, this task corresponds to a forensic extraction or export of a specific data set for later search and examination process using forensic tools.

The extraction of specific data files and folders can also be performed on a live running system if the full physical forensic image can not be done for any technical reason, such as hardware or encryption issue for example.

The exported set of data (selected files and folders) will be saved anyway in a forensic container file (image file) before any examination, indexing and search process, to avoid the alteration of original evidence source data.

For each forensic image file an acquisition hash is created. It is the result of an algorithmic calculation which produces a unique string of characters that act as a digital “fingerprint” for a particular data set. It helps to authenticate the forensic copy and can be used to verify the state and  integrity of evidence data.

The customer will get a detailed forensic report regarding the access to the original source data, the selection, the extraction process performed and the creation of the forensic image (copy).

The forensic specialist can then decide about the best approach and the forensic tools to be used for the next stage of data processing, examination and search methods to find facts and relevant evidence. It will depend what is the case about and what is the objective of the request.