3_privacy Consulting Investigators wpe14.jpg (1194 bytes)

 120018RSpcwindow.jpg (75922 bytes)

1629 K Street NW, Suite 311
Washington, DC  20006


As more and more of everyone's daily activities are automatically recorded by computer files,
there is more need for computer forensics consultants to help in court cases,
to help convict those who are guilty, and free those who are wrongfully accused.

"When you have eliminated the impossible, whatever remains, however improbable, must be the truth"
Sherlock Holmes, literary Consulting Detective

Our services include:

bulletFinding evidence on computers in a non-invasive way, preserving important details
bulletExpert Witness Testimony in court
bulletComputer security procedures
bulletEmployee resource monitoring
bulletLost or deleted evidentiary file recovery
bulletInformation access analysis
bulletHacker tracing, intrusion detection
bulletSystem access management
bulletFile access timeline
bulletMonitoring software installation, utilization, detection and removal
bulletPassword cracking, recovery, decryption and encryption
bulletOn-site or laboratory analysis
bulletElectronic Data Discovery
bulletElectronic Evidence Analysis
bulletAdvising on computer security
bulletPerforming hard drive imaging
bulletDetecting data alteration
bulletVehicle tracking by GPS
bulletProviding Bates numbering for your e-documents
bulletTraining classes
bulletSupporting law enforcement in the pursuit of truth and justice

wpe14.jpg (1707 bytes)
Symantec Security Consultant


"Paul Drake" for the following "Perry Masons"

Doing the "leg work" for the attorneys

"Shaddock is a very conscientious and thorough investigator."
Robert Stone, Esq.  BobStoneLaw.com
Bob Stone

"No one gathers evidence and organizes it better for me than Shaddock."
Leon Demsky, Esq.  Demsky.com
wpe2D.jpg (10178 bytes)

Ian Williams, Esq.
Robert Shaddock, Esq.  Judge Bob
Nash O. Thompson, PhD, Truth & Justice Foundation
Lawrence Farwell, PhD, BrainFingerprinting.com
John Christopher Belcher, Esq.  JCBelcher.com

wpeE.jpg (5161 bytes) 

High Tech Crime Network
Certified Computer Crime Investigator

Rick Shaddock
Member 1289

Hardware and Operating Systems   wpe15.jpg (993 bytes) wpe8.jpg (1353 bytes) wpe16.jpg (1368 bytes) apple.jpg (1197 bytes)  wpeE.jpg (1168 bytes) HP.gif (15238 bytes)

Windows, Netware, DOS, Macintosh, Android, Palm, Palmtops, PDAs, Zip dives and other storage media

Some recent cases

Considering the evidence in the conference room to solve a client's case of computer hacking

We proved that a felony phone threat suspect was innocent because voice mail was truncated.

We proved an abusive husband forged the signature on his wife's $100000 Life Insurance Policy,
sold her car without her knowledge, left her a car with bad brakes, contributing to her fatal accident.

We proved a company owner falsely accused a former employee of assault,
and created a computer generated voice "phone threat".

Computer Forensics  wpe1.jpg (1852 bytes)

Computer forensics is the application of computer investigation and analysis techniques for determining potential legal evidence. Evidence might be sought in a wide range of computer crime or misuse, such as theft of trade secrets, theft of or destruction of intellectual property, and fraud. Computer specialists can draw on various methods for discovering data that reside in a computer system, or recovering deleted, encrypted, or damaged file information. Any or all of this information may help during discovery, depositions, or litigation

Mar23128.jpg (99051 bytes)
The Supreme Court


An impartial computer expert who helps during discovery will typically have experience on a wide range of computer hardware and software. This is especially beneficial when your case involves hardware and software with which this expert is directly familiar. But fundamental computer design and software implementation is often quite similar from one system to another, and experience in one application or operating system area is often transferable to a new system.

Unlike paper evidence, computer evidence can exist in many forms, with earlier versions still accessible on a computer disk. Knowing the possibility of their existence, even alternate formats of the same data can be discovered. The discovery process can be served well by a knowledgeable expert identifying more possibilities that can be requested as possibly relevant evidence.

In addition, during on-site premises inspections, for cases where computer disks are not actually seized or forensically copied, the forensics expert can more quickly identify places to look, signs to look for, and additional information sources for relevant evidence. These may take the form of earlier versions of data files, such as memos and spreadsheets, which still exist on the computer's disk or on backup media, or differently formatted versions of data, either created or treated by other application programs.

Common Application Programs

Word processors wpeF.jpg (1176 bytes) Microsoft Word,  wpe5.jpg (1159 bytes) WordPerfect
Spreadsheets excel.jpg (1183 bytes) Microsoft Excel, wpeC.jpg (1177 bytes) Lotus 1-2-3
eMail wpeE.jpg (1020 bytes) Microsoft Outlook, wpeB.jpg (1155 bytes) Eudora,  wpe2.jpg (1071 bytes) AOL
Timeline and scheduling  project.jpg (869 bytes) Microsoft Project, Symantec TimeLine, Primavera
Graphics wpe6.jpg (1100 bytes) GIF, JPG, BMP
Databases wpe12.jpg (1139 bytes)Access, dbase.jpg (1184 bytes) dBase,  wpe9.jpg (1289 bytes) Oracle, wpe7.jpg (1212 bytes) ODBC
Contact Management act_icon.gif (1206 bytes) ACT!, goldmine_icon.gif (1259 bytes)Goldmine,  wpeE.jpg (1168 bytes) PDAs


Protection of evidence is critical  wpe17.jpg (1100 bytes)

A knowledgeable computer forensics professional will ensure that a subject computer system is carefully handled to ensure that:

  1. No possible evidence is damaged, destroyed, or otherwise compromised by the procedures used to investigate the computer.
  2. No possible computer virus is introduced to a subject computer during the analysis process. 
  3. Extracted and possibly relevant evidence is properly handled and protected from later mechanical or electromagnetic damage.
  4. A continuing chain of custody is established and maintained.
  5. Business operations are affected for a limited amount of time, if at all.
  6. Any client-attorney information that is inadvertently acquired during a forensic exploration is ethically and legally respected and not divulged.

120018RSpcwindow.jpg (75922 bytes)


Procedures wpeD.jpg (1187 bytes)

The computer forensics specialist will take several careful steps to identify and attempt to retrieve possible evidence that may exist on a subject computer system:
bulletRecovers all (or as much as possible) of discovered deleted files. wpe9.jpg (1186 bytes)
bulletProtects the subject computer system during the forensic examination from any possible alteration, damage, data corruption, or virus introduction.
bulletDiscovers all files on the subject system. This includes existing normal files, deleted yet remaining files, hidden files, password-protected files, and encrypted files.
bulletReveals to the extent possible, the contents of hidden files as well as temporary or swap files used by both the application programs and the operating system.
bulletAccesses, if possible and legally appropriate, the contents of protected or encrypted files.
bulletAnalyzes all possibly relevant data found in special, and typically inaccessible, areas of a disk. This includes but is not limited to what is called 'unallocated' space on a disk (currently unused, but possibly the repository of previous data that is relevant evidence), as well as 'slack' space in a file (the remnant area at the end of a file, in the last assigned disk cluster, that is unused by current file data, but once again may be a possible site for previously created and relevant evidence).
bulletPrints out an overall analysis of the subject computer system, as well as a listing of all possibly relevant files and discovered file data. Further, provides an opinion of the system layout, the file structures discovered, any discovered data and authorship information, any attempts to hide, delete, protect, encrypt information, and anything else that has been discovered and appears to be relevant to the overall computer system examination. 
bulletProvides expert consultation and/or testimony, as required. 

investigator.jpg (2120 bytes)





Applications of Computer Forensics wpe6.jpg (1251 bytes)

Many types of criminal and civil proceedings can and do make use of evidence revealed by computer forensics specialists:
bulletCriminal Prosecutors use computer evidence in a variety of crimes where incriminating documents can be found: homicides, financial fraud, drug and embezzlement record-keeping, and child pornography.
bulletCivil litigations can readily make use of personal and business records found on computer systems that bear on: fraud, divorce, discrimination, and harassment cases.
bulletInsurance Companies may be able to mitigate costs by using discovered computer evidence of possible fraud in accident, arson, and workman's compensation cases.
bulletCorporations often hire computer forensics specialists to ascertain evidence relating to: sexual harassment, embezzlement, theft or misappropriation of trade secrets and other internal/confidential information.
bulletLaw Enforcement Officials frequently require assistance in pre-search warrant preparations and post-seizure handling of the computer equipment. 
bulletIndividuals sometimes hire computer forensics specialists in support of possible claims of: wrongful termination, sexual harassment, or age discrimination.

wpe5.jpg (10624 bytes)

Where Can Clues Be Found?

bulletDownloaded files and pictures
bulletChat sessions
bulletWeb sites visited
bulletAutocomplete information
bulletTemp folders
bulletRecent Files list
bulletRecycle Bin
bulletBrowser cache
bulletHistory logs
bulletSlack space
bulletand more...

wpe2D.jpg (5999 bytes)

wpeC.jpg (1620 bytes)

Computer Forensic Tools


Basic WinZip Technique

Norton Utilities

Caller Id Spoof Awareness

wpe2E.jpg (2073 bytes)


Image204.jpg (96052 bytes)
Special storage device enables contents of seized hardware to be recorded without changing the contents


wpe1C.jpg (16404 bytes)
Recording data on CD enables the user to continue to use his or her computer during the investigation.

Law Enforcement Links

wpeE.jpg (5161 bytes) 

High Tech Crime Network
Certified Computer Crime Investigator

Rick Shaddock
Member 1289

wpeB.jpg (23131 bytes)

National Forensic Center

17 Temple Terrace
Lawrenceville, NJ  08648

Locating Expert Witnesses and Litigation Consultants Nationwide



by Guidance Software

EnCase Forensics Tools

bulletDeeper e-mail analysis
bulletWeb browsing display support, including detailed access to browsing history
bulletExpanded support for the most popular Web browsers
bulletNew Linux for EnCase for bootable forensic CDs
bulletAn enhanced acquisition engine
bulletMore robust digital evidence administration
bulletCreation of “Logical evidence files”
bulletEasier recognition and improved clarification in the Case view

Terry Harrington investigated and exonerated using forensic brain wave science, MERMER, P300 and brain fingerprinting developed by Dr. Farwell, to establish guilt or innocence

We assist Dr. Lawrence Farwell
Ph.D. in NeuroPhysiology from University of Illinois
Bachelors from Harvard University

has both solved a serial murder case
and freed a man falsely accused

wpeB.jpg (8333 bytes)

Truth & Justice Foundation

Enlightened Sentencing Project

National Association of Investigative Specialists

High Technology Crime Investigation Association

U.S. Secret Service

Best Practices for Seizing Electronic Evidence

Department of Defense Seal

Department of Defense

Computer Forensic Laboratory - DCFL


wpe2D.jpg (10178 bytes)

Leon Demsky, Esq.

Attorney at Law, Arlington VA


wpe1B.jpg (21338 bytes)

Ian A. Williams, Esq.

Attorney at Law, Washington DC


Robert Stone, Esq.

Attorney at Law, Arlington and Washington


sherlock.jpg (25582 bytes)

Metropolitan Detective Agency

wpeC.jpg (2857 bytes)


wpeA.jpg (2251 bytes)

EnCase Certification

The recognized leader in computer investigation certification

Certification Seminar

Forensics Toolkit


Certifications of Dan Mares

bulletHTCIA, High Technology Crime Investigation Association Atlanta chapter president, vice president, secretary
bulletIISFA, International Information Systems Forensics Association Atlanta Chapter, Training director
bulletIACIS, International Association of Computer Investigative Specialists IACIS.
bulletISSA, Information Systems Security Association. ISSA

wpe1C.jpg (2753 bytes)

ContentWatch.com - free content audit

There are a number of ways objectionable material can find its way onto your computer without your knowledge or permission. Some of the most common ways are through receiving email, and intentionally or accidentally accessing inappropriate websites.    This tool can help you avoid wrongful accusation.


wpe1B.jpg (6645 bytes)

International Association for Cryptologic Research

wpe14.jpg (1707 bytes)

Symantec Security Consultants




MaresWare.com - useful utilities

wpeA.jpg (1293 bytes)

Center on Wrongful Convictions, Northwestern University


Paul J. Riley

Attorney at Law, Washington DC


Ken Klein

Attorney at Law, Washington DC


Ken Ketterhagen, Esq.

Attorney at Law, Fairfield, IA 52556

wpe2E.jpg (2096 bytes)

Robert Shaddock, Esq.
Attorney at Law, Rochester NY
Judge: Pittsford NY


Brandon Nelson, Esq.


Attorney at Law, Fairfield IA
under construction


Scott Sexauer

Attorney at Law, Springfield VA


wpe11.gif (3144 bytes)

Computer Instructors Corporation

FACES and other computer software training
for law enforcement personnel in the Washington DC area

Dr. Joseph Bell
Edinburgh, Scotland doctor and instructor of surgery
of the late 1800's
whose amazing powers of observation and deduction
were Sir Arthur Conan Doyle's
inspiration for the Sherlock Holmes stories.

Dr. Bell helped Scotland Yard to stop  Jack the Ripper




GlobalSat DG-100


Vehicle tacking services

We place a device and provide a report of the whereabouts.



You can get some clues from previous web sites

Investigating the Biggest Murder Mystery in American History


Sherlock Holmes

Rick has read all 60 stories
by Sir Arthur Conan Doyle
starting at a young age.

Other Investigators in books and movies

"I'm a consulting detective.  I invented the job"
Sherlock Holmes


a division of C I Corporation