Return to BTJ Online

Computer Forensics Services provides computer evidence for investigations

by Kathy Hagood
Brevard Technical Journal

Dan Sparling is President of Computer Forensics Services in Titusville. The company specializes in finding deleted data for use in investigations of wrongdoing. Photo by Mike Giannacco, © 2005.

Computer Forensics Services in Titusville is a small company hoping to make a big impact in the emerging field for which it's named.

While much of the public still believes that once data has been deleted from a computer it is irretrievable, certified computer examiners like those at Computer Forensic Services root out deleted data for use in proving or disproving suspected wrongdoing.

Computer evidence can be used to address such suspected problems as embezzlement, fraud or sexual harassment. It can also be used to help solve more serious crimes like murder, as the popular show "CSI" has shown.

"Most people don't realize how much deleted data can be recovered from a computer, not just computer files, but also e-mails and the Web sites someone has visited," said Dan Sparling, president of the company.

Sparling works with a consultant, David Ungar, to tag team computer investigations in the business arena.

The two, who are also space program workers, help organizations recover and analyze computer data pertaining to mergers, acquisitions, bankruptcy and financial law, corporate criminal investigations, pre-trial evidence and litigation in the areas of healthcare, construction, employment, banking and product liability.

They can thoroughly examine hard drives and any other form of memory media, including floppy disks, Zip disks and memory cards.

Sparling and Ungar can also retrieve data from crashed hard drives or crack critical passwords for clients have lost track of them. Data thought to have been destroyed by computer worms can be recovered.

Sparling has a master's degree in computer science and 17 years of technical and IT experience. Ungar also has a master's degree in computer science, as well as 14 years of IT experience. Sparling's expertise is more heavily weighed toward computer software and Ungar toward hardware.

The two work in tandem to speed the process and provide more thorough investigations.

"We make a great team," Ungar said.

Both are certified computer examiners, which means they have been trained to collect computer evidence in a methodi-cal manner that will allow its use in court. The two can also provide expert witness testimony for court cases using computer evidence.

"How you retrieve data is critical for its admissibility in court. Every step has to be correct-ly documented," Sparling said.

Sparling and Ungar estimate it takes about 30 hours to fully examine a hard drive using proper documentation techniques and approved retrieval software.

"It helps if the client is seeking something specific. Pointing to the computer and saying 'look for any wrongdoing' is too general," Sparling said.

One of the team's first steps is make a copy of the hard drive, including what looks to be blank spaces.

It is in the "blank" spaces that deleted data hides from the regular computer. But the data is easily retrieved by an examiner with the proper training and software to do a job.

"When you delete a file, it just deletes the pointer to the data, but the data stays there," Sparling said.

Over time such silent files can be overwritten, but they oftentimes reside untouched on the computer for months or years.

Sparling and Ungar refer to a case where a woman charged sexual harassment by a coworker two years after she left a company. Computer forensics applied to her old computer retrieved e-mail correspondence, including a nude photo, that proved her relationship with the coworker was voluntary.

"That's the thing to remember, forensics can help prove or disprove," Ungar said.

The true story illustrates another dimension of the pair's work, "sanitizing" hard drives. While even computer savvy users may think a simple reformatting wipes a hard drive clean, such tactics don't truly erase data.

"Formatting a drive doesn't protect you in the least from someone who knows what they are doing. Businesses and individuals may donate computers that have critical data on them like credit card numbers or proprietary secrets," Ungar said.

Computer Forensics Services uses sophisticated software that truly wipes hard drives clean and allows them to be safely donated.

Sparling and Ungar are targeting area attorneys and law enforcement agencies for their marketing outreach. They have found that many organizations in the area aren't aware of how much data can be retrieved by using computer forensics techniques.

"It's an important tool but it's underutilized here," Sparling said. "As businesses, attorneys and law enforcement officials become more knowledgeable about its potential, we're going to see a growing demand for our services," Sparling said.

For more information, call 888-252-0731 or visit www.computer-forensics-services.com