In the world of the 21st century, data is truly inescapable. It permeates every aspect of our lives, whether we are aware of it or not. We constantly create information about our interests, our behaviors, our actions, and our whereabouts. The information we create lives on our computers at work and at home, on our smartphones, and in countless other devices, even the computer systems in our cars and IoT-enabled smart appliances. With the aid of modern technology, we record our lives more now than at any point in human history.
Computer forensics involves looking at digital information wherever it exists, from smartphones and smartwatches to smart tea kettles, and piecing it together to be used as evidence or to reconstruct what occurred.
The Goals of a Digital Forensic Examiner
Identify and safely collect the device(s) containing digital evidence
Assess the digital evidence on a device to determine the correct course of action
Acquire the data from the device in a manner that best protects and preserves the integrity of that data
Extract and analyze the digital evidence from the device, interpreting the recovered data
Document all actions taken and observations made throughout the forensic process
Prepare a clear, accurate, and impartial report on digital forensics findings
Data Always Has a Story to Tell
The Gillware Digital Forensics experts use their skills and knowledge to retell these stories to our clients, including:
Law enforcement officers seeking evidence in criminal investigations
Legal firms in search of information for criminal or civil litigation
Corporations needing data for employment disputes, employee exit and more
Any other entity in need of digital forensic investigative services
Helmed by digital forensics expert Cynthia A. Murphy M.Sc., Gillware meets the needs of clients across the nation from our digital forensics firm in Madison, Wisconsin. At Gillware Digital Forensics, vast forensics expertise and cutting-edge data recovery tools and techniques come together to offer over 25 years of combined forensics and data retrieval experience.
Our Digital Forensics Services
Mobile Device Forensics
When mobile devices are involved in investigations, digital evidence remains within them waiting to be uncovered. Mobile device forensics is the service through which examiners extract and make sense of the data stored within a mobile device.
JTAG and chip off forensics techniques allow access to a device’s contents on a physical level. Investigators create and sort through a raw data dump of the smartphone’s NAND or NOR flash memory chips.
Data stored on a hard drive tells a story. A forensic investigator’s job is to examine the data and piece the story together. The files on a hard drive and the metadata defining them can reveal how and when the hard drive was used.
With more solid state drives on the market, forensic examiners are likely to see more of these devices as time goes on, making SSD forensics an increasingly important expertise area for forensics labs.
SD cards are common in cameras, phones and other devices. A skilled forensic examiner can help determine who was using an SD card, what kind of data exists on the card, when was the card used, and for what purpose.
The convenience of USB flash drives makes them a common sight, which means they can hold key evidence for investigations, especially those relating to corporate espionage and intellectual property theft.
In today’s digital age, data lives everywhere. Data stored on the most unusual of devices can often be of evidentiary value, including drones, GPS devices, audio recorders, surveillance cameras and more.
The expert witness’s role is to explain technical evidence to the jury and the court in ways that are clear and easy to comprehend. They should be experienced in the courtroom and maintain integrity and objectivity.
To ensure our clients receive exactly the level of service they require, Gillware Digital Forensics offers a tiered process. There can be multiple phases of work in the digital forensics process and this system allows our clients to choose specific steps of the process to meet their specific needs.
Prior to sending in the device for an initial assessment, we highly recommend our clients give us a call to discuss the case.
1. Initial Assessment
Gillware provides the necessary shipping materials to send the device to our digital forensics lab in Madison, Wisconsin. Within two business days of receiving the device, our examiners will create a report on the device, its condition, and what types of data we think are able to be retrieved. Finally, we provide a 30-minute consultation to discuss the device, what types of data extraction and analysis are possible and what the cost might be for data extraction, further analysis, etc.
2. Data Extraction & Analysis
The second step involves attempting to extract data from the device with priority placed on specific data that is deemed relevant to the case. After extraction, a report is drafted on the data assets of the device. Step two concludes with a one-hour forensic consultation to discuss the results of the extraction and analysis to determine whether further work is required. Gillware also provides one year of forensically-sound image storage in case a client needs to return to their case in the future.
3. Forensic Analysis & Report
If further analysis is required, our forensic examiners will conduct an in-depth processing of the data, after which a peer-reviewed forensic report is created and consultation with a forensic examiner is provided to walk through the results. Gillware will then give the report and extracted data back to the client.
4. Expert Testimony
The final phase of the forensic process is expert testimony in a court of law. Though many cases do not require expert testimony, it is often the most important part of the process for those that do. Forensic reports are only valuable to a case if they can be clearly communicated to the relevant parties, as technical confusion should not be a factor in the outcome of a case.
Gillware’s digital forensics and data recovery labs offer very different services, but it can sometimes be hard to tell which umbrella your needs fall under. Our “Data Recovery or Digital Forensics?” page outlines where you should go based on your needs.
About Our President, Cynthia A. Murphy, M.Sc.
With her 30+ years as a law enforcement officer and 17+ years working in Digital and Mobile Forensics, Cindy Murphy is well-known in the industry for her deep knowledge of the field, her many years of experience and for solving new and difficult problems on a consistent basis.
She is a certified forensic examiner and obtained her M.Sc. in Forensic Computing and Cyber Crime Investigation through University College, Dublin in 2011 where she completed her dissertation titled “A Multidisciplinary Approach to Child Age Estimation.” She has completed a great number of digital and mobile forensics training programs over the course of her career and has also participated in cross-training with computer forensic examiners from the FBI, Secret Service, Royal Canadian Mounted Police, and An Garda Siochana (the police force of Ireland). Additionally, Cindy is a SANS Certified Instructor, EnCase Certified Examiner, Certified Computer Forensics Technician and is recommended by Cellebrite.
Cindy has been teaching digital and mobile forensics since 2002 for various public and private teaching programs and has been involved in the development of curriculum for digital and mobile device forensics. She has helped to establish two separate digital forensics labs and networks in law enforcement and educational environments. Cindy has testified as a digital and mobile forensics expert in both state and federal courts on numerous occasions, has presented internationally on various digital forensics and cybercrime topics, and she frequently contributes articles, webinars, and whitepapers to the forensics community. Cindy is also a veteran, a mother, a musician (4- and 5-string banjo, cello, tenor guitar, mandolin and ukulele), a protester for first amendment rights, a Brittany Spaniel enthusiast, and an expert knot tier.
As President of Gillware Digital Forensics, Cindy Murphy oversees the entire operation at our digital forensics lab in Madison, WI. From the procedures and quality assurance measures employed in the processing of every case, to her work with our engineering team on advanced digital forensics tools and techniques, Cindy ensures that Gillware remains at the forefront of the digital forensics industry.
Gillware Digital Forensics – President/Lead Forensic Examiner – 2016-Present
SANS Institute – Certified SANS Instructor – 2012-Present
Madison Police Department – Detective – Computer Forensics and Computer Crimes Investigations – 1991-2016
Madison Area Technical College – Part Time Digital Forensics Instructor – 2007-2014
Department of Veterans Affairs – Police Officer – 1989-1991
United States Army – Military Police Officer – 1985-1989
SANS Certified Instructor, Digital Forensics and Incident Response Team – 2014-Present