Gillware’s Digital Forensics Process

Our process is designed to allow our customers and clients to pay for our services as they go, ensuring they get precisely the level of service their particular situation requires. Performing digital forensics work can involve many different phases, but the reality is that not every case requires a complete peer reviewed forensic report coupled with expert testimony.

In some situations, your primary goal might be to find out if it is even possible to extract data from a locked mobile device or a broken hard drive. In other cases, you might simply want to get pictures off the phone of a deceased loved one. Yet in other situations, your case might end up in court and require a Gillware examiner to provide a full digital forensic report and expert testimony.

Regardless of the type or level of digital forensic service, Gillware is capable of providing exactly what you need precisely when your case or situation dictates you need it. There is no need to pay for advanced and expensive digital forensics services prior to knowing if you’ll actually need them. We’ll even hold on to a forensically sound image of your device for one year as part of our service, just in case the specifics of your case have changed and further analysis is required.

Step 1: Initial Assessment

The initial assessment starts with Gillware sending you what we call our digital forensics starter kit. The kit includes a box, packaging material, evidence collection bag, chain of custody documentation (if required), a pre-paid UPS return shipping label (if you reside in the U.S.) and packing instructions to ensure your device(s) get to Gillware safely.

Within two business days, we create an assessment report that includes documentation of the device properties and its condition. Based on this information, our forensics examiners estimate the types of data that can be extracted as well as what types of forensic analysis are possible. The initial assessment concludes with a 30-minute forensic consultation in which we discuss what the cost will be for the data extraction process and further forensic analysis if required.

Step 2: Data Extraction and Analysis

During the data extraction and analysis phase, our engineers and forensic examiners will perform the work necessary (device repair, password bypass/cracking, JTAG, chip-off, etc.) in order to attempt to extract the data from your device. Priority will be placed on the specific information and data that you identify as critical or important to your particular case. You will be provided with a report on the data assets of the device.

Along with the report, Gillware provides a one-hour consultation with the forensic examiner who worked on your case to discuss the results, during which you will decide if the case requires further forensic analysis. If you are unsure if further forensic analysis is required, you will receive one year of secure, forensically sound image storage in case you need to return to the case at a later date. If no further analysis is required, Gillware will send the report along with the extracted data back to you.

Step 3: Forensic Analysis and Report

In instances where further analysis is required, Gillware will create a full forensic report. Prior to beginning this report, you will be provided with a statement of work with details on the analysis that will be performed and an estimate of the hours and cost. The work itself will include an in-depth processing of the data, a peer-reviewed formal forensic report, and consultation with a forensic examiner to walk through the results. Upon completion, Gillware will return the report along with the extracted data back to you.

With Gillware’s tiered process, personal consultation, and experienced team of professionals, you can rest assured that your case will be completed on time, within budget, and with the greatest chance of success.

Step 4: Expert Testimony

Though many cases will not require expert testimony, it is often the most important component for those that do. Comprehensive forensic reports are only useful in the courtroom so long as there is an expert present that is capable of clearly communicating the results. Technical confusion should not be a factor in the outcome of a case and to prevent this, Gillware is able to provide expert testimony as needed.

Our forensic experts not only possess deep knowledge of the digital forensics field and the work that we do, but also have experience in the courtroom. For more information on expert testimony, please visit our expert testimony page.

To start a new case, follow the link below to request an initial consultation with Gillware.