Workstations / servers / arrays
Disk forensics: workstations, laptops, servers and storage arrays
Reviewed on .
Bit-for-bit imaging of workstations, laptops and servers, artifact-level analysis of Windows, macOS and Linux systems, and reporting for counsel and IT.
Get a free consultation
Disk-level examination is the fallback when tenant logs are gone, the retention window has closed, or the matter turns on what a specific user did on a specific device. We plan the imaging so the source is preserved, the image is verifiable, and the analysis maps to counsel's questions.
Common scopes: physical and logical imaging, RAID and encrypted-volume reconstruction, USB and external-storage history, browser and application activity reconstruction, deleted-file recovery, and timeline analysis. See computer & drive forensics and data recovery.
For departing-employee matters where disk is one of several sources, pair with departing employee analysis.
Related services
Related computer & drive forensics
Also examined for this kind of matter
Discuss this matter with GDF
Confidential intake reviewed by a New York examiner. Reference the deadline, the devices or accounts involved, and how counsel or IT wants to receive the initial call.
Prefer email? Use gdfleads@evestigate.com. 24/7 line: 877.504.3580.