Consulting Investigators

1629 K Street NW, Suite 311
Washington, DC 20006
1-202-829-4444

ConsultingInvestigators.com

As more and more of everyone's daily activities are automatically recorded by computer files,
there is more need for computer forensics consultants to help in court cases,
to help convict those who are guilty, and free those who are wrongfully accused.

"When you have eliminated the impossible, whatever remains, however improbable, must be the truth"
Sherlock Holmes, literary Consulting Detective

Our services include:

	Finding evidence on computers in a non-invasive way, preserving important details
	Expert Witness Testimony in court
	Computer security procedures
	Employee resource monitoring
	Lost or deleted evidentiary file recovery
	Information access analysis
	Hacker tracing, intrusion detection
	System access management
	File access timeline
	Monitoring software installation, utilization, detection and removal
	Password cracking, recovery, decryption and encryption
	On-site or laboratory analysis
	Electronic Data Discovery
	Electronic Evidence Analysis
	Advising on computer security
	Performing hard drive imaging
	Detecting data alteration
	Vehicle tracking by GPS
	Providing Bates numbering for your e-documents
	Training classes
	Supporting law enforcement in the pursuit of truth and justice

Symantec Security Consultant

"Paul Drake" for the following "Perry Masons"

Doing the "leg work" for the attorneys

"Shaddock is a very conscientious and thorough investigator."
Robert Stone, Esq. BobStoneLaw.com

"No one gathers evidence and organizes it better for me than Shaddock."
Leon Demsky, Esq. Demsky.com
wpe2D.jpg (10178 bytes)

References
Ian Williams, Esq.
Robert Shaddock, Esq. Judge Bob
Nash O. Thompson, PhD, Truth & Justice Foundation
Lawrence Farwell, PhD, BrainFingerprinting.com
John Christopher Belcher, Esq. JCBelcher.com

High Tech Crime Network
Certified Computer Crime Investigator

Rick Shaddock
Member 1289

Hardware and Operating Systems

Windows, Netware, DOS, Macintosh, Android, Palm, Palmtops, PDAs, Zip dives and other storage media

Some recent cases

Considering the evidence in the conference room to solve a client's case of computer hacking

We proved that a felony phone threat suspect was innocent because voice mail was truncated.

We proved an abusive husband forged the signature on his wife's $100000 Life Insurance Policy,
sold her car without her knowledge, left her a car with bad brakes, contributing to her fatal accident.

We proved a company owner falsely accused a former employee of assault,
and created a computer generated voice "phone threat".

Computer Forensics

Computer forensics is the application of computer investigation and analysis techniques for determining potential legal evidence. Evidence might be sought in a wide range of computer crime or misuse, such as theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer specialists can draw on various methods for discovering data that reside in a computer system, or recovering deleted, encrypted, or damaged file information. Any or all of this information may help during discovery, depositions, or litigation

Mar23128.jpg (99051 bytes)
The Supreme Court

Benefits

An impartial computer expert who helps during discovery will typically have experience on a wide range of computer hardware and software. This is especially beneficial when your case involves hardware and software with which this expert is directly familiar. But fundamental computer design and software implementation is often quite similar from one system to another, and experience in one application or operating system area is often transferable to a new system.

Unlike paper evidence, computer evidence can exist in many forms, with earlier versions still accessible on a computer disk. Knowing the possibility of their existence, even alternate formats of the same data can be discovered. The discovery process can be served well by a knowledgeable expert identifying more possibilities that can be requested as possibly relevant evidence.

In addition, during on-site premises inspections, for cases where computer disks are not actually seized or forensically copied, the forensics expert can more quickly identify places to look, signs to look for, and additional information sources for relevant evidence. These may take the form of earlier versions of data files, such as memos and spreadsheets, which still exist on the computer's disk or on backup media, or differently formatted versions of data, either created or treated by other application programs.

Common Application Programs

Word processors	Microsoft Word, WordPerfect
Spreadsheets	Microsoft Excel, Lotus 1-2-3
eMail	Microsoft Outlook, Eudora, AOL
Timeline and scheduling	Microsoft Project, Symantec TimeLine, Primavera
Graphics	GIF, JPG, BMP
Databases	Access, dBase, Oracle, ODBC
Contact Management	ACT!, Goldmine, PDAs

Protection of evidence is critical

A knowledgeable computer forensics professional will ensure that a subject computer system is carefully handled to ensure that:

No possible evidence is damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer.
No possible computer virus is introduced to a subject computer during the analysis process.
Extracted and possibly relevant evidence is properly handled and protected from later mechanical or electromagnetic damage.
A continuing chain of custody is established and maintained.
Business operations are affected for a limited amount of time, if at all.
Any client-attorney information that is inadvertently acquired during a forensic exploration is ethically and legally respected and not divulged.

120018RSpcwindow.jpg (75922 bytes)

Procedures

The computer forensics specialist will take several careful steps to identify and attempt to retrieve possible evidence that may exist on a subject computer system:

Recovers all (or as much as possible) of discovered deleted files.

Protects the subject computer system during the forensic examination from any possible alteration, damage, data corruption, or virus introduction.

Discovers all files on the subject system. This includes existing normal files, deleted yet remaining files, hidden files, password-protected files, and encrypted files.

Reveals to the extent possible, the contents of hidden files as well as temporary or swap files used by both the application programs and the operating system.

Accesses, if possible and legally appropriate, the contents of protected or encrypted files.

Analyzes all possibly relevant data found in special, and typically inaccessible, areas of a disk. This includes but is not limited to what is called 'unallocated' space on a disk (currently unused, but possibly the repository of previous data that is relevant evidence), as well as 'slack' space in a file (the remnant area at the end of a file, in the last assigned disk cluster, that is unused by current file data, but once again may be a possible site for previously created and relevant evidence).

Prints out an overall analysis of the subject computer system, as well as a listing of all possibly relevant files and discovered file data. Further, provides an opinion of the system layout, the file structures discovered, any discovered data and authorship information, any attempts to hide, delete, protect, encrypt information, and anything else that has been discovered and appears to be relevant to the overall computer system examination.

Provides expert consultation and/or testimony, as required.

investigator.jpg (2120 bytes)

Applications of Computer Forensics

Many types of criminal and civil proceedings can and do make use of evidence revealed by computer forensics specialists:

Criminal Prosecutors use computer evidence in a variety of crimes where incriminating documents can be found: homicides, financial fraud, drug and embezzlement record-keeping, and child pornography.

Civil litigations can readily make use of personal and business records found on computer systems that bear on: fraud, divorce, discrimination, and harassment cases.

Insurance Companies may be able to mitigate costs by using discovered computer evidence of possible fraud in accident, arson, and workman's compensation cases.

Corporations often hire computer forensics specialists to ascertain evidence relating to: sexual harassment, embezzlement, theft or misappropriation of trade secrets and other internal/confidential information.

Law Enforcement Officials frequently require assistance in pre-search warrant preparations and post-seizure handling of the computer equipment.

Individuals sometimes hire computer forensics specialists in support of possible claims of: wrongful termination, sexual harassment, or age discrimination.

wpe5.jpg (10624 bytes)

Where Can Clues Be Found?

	Downloaded files and pictures
	Popups
	Chat sessions
	Web sites visited
	Autocomplete information
	Index.dat
	Temp folders
	Recent Files list
	Recycle Bin
	Browser cache
	Cookies
	History logs
	Slack space
	and more...

wpe2D.jpg (5999 bytes)

wpeC.jpg (1620 bytes)

Computer Forensic Tools

Encase

Basic WinZip Technique

Norton Utilities

Caller Id Spoof Awareness

wpe2E.jpg (2073 bytes)

Special storage device enables contents of seized hardware to be recorded without changing the contents

CICorporation.US
ComputerInvestigate.com
ConsultingInvestigators.com
Laboratory
800-319-3190

Recording data on CD enables the user to continue to use his or her computer during the investigation.

Law Enforcement Links

High Tech Crime Network
Certified Computer Crime Investigator

Rick Shaddock
Member 1289

National Forensic Center

17 Temple Terrace
Lawrenceville, NJ 08648
800-526-5177

Locating Expert Witnesses and Litigation Consultants Nationwide

http://expertindex.com

EnCase

by Guidance Software

EnCase Forensics Tools

	Deeper e-mail analysis
	Web browsing display support, including detailed access to browsing history
	Expanded support for the most popular Web browsers
	New Linux for EnCase for bootable forensic CDs
	An enhanced acquisition engine
	More robust digital evidence administration
	Creation of �Logical evidence files�
	Easier recognition and improved clarification in the Case view

We assist Dr. Lawrence Farwell
Ph.D. in NeuroPhysiology from University of Illinois
Bachelors from Harvard University
RecognitionResponse.com
has both solved a serial murder case
and freed a man falsely accused
BrainFingerprinting.com

Truth & Justice Foundation

Enlightened Sentencing Project

National Association of Investigative Specialists
InvestigativeSpecialists.Org

High Technology Crime Investigation Association

U.S. Secret Service

Best Practices for Seizing Electronic Evidence

Department of Defense Seal

Department of Defense

Computer Forensic Laboratory - DCFL

DCFL.Gov

wpe2D.jpg (10178 bytes)

Leon Demsky, Esq.

Attorney at Law, Arlington VA

DemskyLaw.com

wpe1B.jpg (21338 bytes)

Ian A. Williams, Esq.

Attorney at Law, Washington DC

IanWilliamsLaw.com

Robert Stone, Esq.

Attorney at Law, Arlington and Washington

BobStoneLaw.com

sherlock.jpg (25582 bytes)

Metropolitan Detective Agency

wpeC.jpg (2857 bytes)

MDBInternational.com

EnCase Certification

The recognized leader in computer investigation certification

Certification Seminar

AccessData
Forensics Toolkit

MaresWare

Certifications of Dan Mares

	HTCIA, High Technology Crime Investigation Association Atlanta chapter president, vice president, secretary
	IISFA, International Information Systems Forensics Association Atlanta Chapter, Training director
	IACIS, International Association of Computer Investigative Specialists IACIS.
	ISSA, Information Systems Security Association. ISSA

wpe1C.jpg (2753 bytes)

ContentWatch.com - free content audit

There are a number of ways objectionable material can find its way onto your computer without your knowledge or permission. Some of the most common ways are through receiving email, and intentionally or accidentally accessing inappropriate websites. This tool can help you avoid wrongful accusation.