QuickLook

Due to common misconceptions of high costs associated with digital investigation services, many potential clients are hesitant to proceed with an investigation if they are unsure of whether or not they have a case. In order to prevent clients from paying for a full investigation when it is unnecessary, the DFC offers a QuickLook service. The QuickLook service will clear up any uncertainties that a client may have and allow them to feel confident in their decision to proceed with a full investigation.

What is the QuickLook Service?

QuickLook service offers an abbreviated analysis of a data set to find evidence at a low cost to the client. Based on the findings from a QuickLook analysis, the DFC will make a recommendation as to whether or not there is reason to proceed with a full investigation.

What is included in the QuickLook Service?

A basic QuickLook service covers the following for a single hard drive or similar piece of digital media:

• A one-hour consultation with a DFC expert to discuss your case.
• A forensically sound acquisition of the digital media that is provided to the DFC.
• Two hours of analysis performed by a DFC certified examiner to determine if there is evidence related to the client's case on the media in question.
• Presentation of basic findings, an expert opinion on case viability, and whether a full investigation is warranted.
• Forensically sound practices and documentation to ensure your evidence is permissible in court, should a hearing occur.
• Low cost to the client and a discount on a full investigation if warranted.

What can the QuickLook service find?

Based on the client's requests the examiner will review the digital media to see if there is data that would support the client's case. This includes reviewing the media for the existence of the following types of evidence:

• Email records
• Internet and network activity
• Deleted or purposely hidden files
• Inappropriate or explicit content
• Digital contraband

What should a client expect at the conclusion of the QuickLook service?

Consider a case of corporate misconduct. An employer may request information related to an employee spending a significant amount of time at work browsing the internet, online shopping, chatting with friends, harassing co-workers, or misusing company time and resources in any other way. In this case the company would provide the computer to the DFC experts. The DFC experts would follow all forensic procedures to document, acquire, and analyze the digital media based on the client's needs. At the conclusion of the analysis the DFC expert will provide a general overview of their findings. This could include statements such as:

• "There is evidence that on a number of occasions the computer was used to spend a significant amount of time reviewing non-work related websites such as ESPN and YouTube."
• "There is evidence that this computer was frequently used to view inappropriate or explicit materials during the work day."
• "While there are a few traces of evidence that this computer was used for on-line shopping, the pattern of activity is not indicative of it being a constant or frequent event."

The investigator will likely not provide the client with detailed information such as any exact dates, times, websites, email accounts, or other details related to the activity. Based on the analysis the investigator will make a recommendation as to whether there is enough evidence to warrant a full investigation. During the full investigation, the investigator will be able to provide details about the evidence found, how it originated on the computer, when it originated on the computer, etc.

What is not included in the QuickLook Service?

The QuickLook service is not a full investigation and will not provided clients with details about evidence found on the media. The basic QuickLook service does not include the following:

• Acquisition of digital media outside the DFC offices.
• Acquisition of more than one piece of digital media.
• Analysis of more than one piece of digital media.
• A copy of the original digital media for the client to keep.
• A written report or production of evidence files.
• Testimony based on the findings of the analysis.

Can the QuickLook service be customized?

Yes. For an additional fee the QuickLook can include acquisition of more than one piece of digital media and acquisition of digital media at a location other than the DFC.