Digital Forensics
Texas Private Security Bureau License # A20303

Certified & experienced digital forensics specialists.

Legally defensible evidence handling procedures are imperative. At Elite Document Technology we understand your concerns and we approach ESI collection, analysis and processing with care, caution and security. As with all aspects of our business, our forensics department is held to the highest of standards. Our specialists are in a constant state of training in order to maintain the highest knowledge level possible within this unique skill set. EDT is a licensed private investigations company within the state of Texas, complying with Texas Occupations Code Chapter 1702.104(b) regarding data collection and forensics analysis performed within our state.  [Click here to view Chapter 1702]

Our Services

The most vital phase of digital forensics is the collection of the data, it must be done in a secure and forensically sound manner or spoliation can occur. Our Certified Computer Examiners have been trained to thoroughly document each collection from start to finish using digital photographs, specially designed forms & field notes. A forensically sound image is a bit by bit copy of the evidence hard drive / media which is verified using tools that calculate the drive's hash value and then compares it to the calculated hash value of the image, only an exact match is verifiable. All target media (media used to acquire the forensic image to) is securely wiped using US Department of Defense standards prior to use in the field or lab. This process assures that there is no chance of spoliation during the imaging process. All collected data is inventoried and securely stored in a fireproof data safe within our lab. Upon determination that the evidence is needed for analysis a working copy of the evidence image is created. All analysis and processing is performed using this "working copy", preserving the original "pristine" image.

Below are two common collection requests:

- Non-Forensic / Targeted Collection -
Data has been pre-populated into a location determined by the client. We use special applications that harvest this data onto clean target media and maintain a chain of custody for the individual files. This would be considered a non-forensic matter because, among other things, the data has been copied or moved from its original location, and there will  be no forensic artifacts to use for examination purposes.

- Forensic Collection -
A bit stream copy of the "evidence" drive or media using forensically validated tools. The image must be an exact duplicate of the original drive and verified using calculated hash values.

We specialize in all of the above along with live collections, RAID reconstruction, straight data recovery, etc.

The Chain of Custody is an integral part of the data certification process. Without a viable chain of custody the data collection process could be useless due to a lack of proof of traceable custodianship. We provide a detailed and foolproof chain of custody with every project to assure that your data will stand up to the scrutiny of the opposition.

Part of the forensic analysis of an evidence drive is the recovery of files and folders that have been deleted. These files and folders are not generally visible or recoverable without the aid of specialized forensically-qualified tools. As a service to our customers, we can attempt to recover all deleted, orphaned or missing files and folders.

We will consult with you to determine your specific interests with every case. Our team of examiners has experience with many different operating systems and environments and will assist you in determining your course. During our investigation will attempt to use a combination of our experience and our tools to piece together the information you are looking to present in your argument.

Our Facility

Within Elite Document Technology's 8,500 square foot facility stands the Digital Forensics Lab. Our lab contains the most recent and reliable offerings in digital forensics hardware and software. There is no outside access by unauthorized individuals and the lab is protected by biometric and deadbolt security. Our 40 cubic foot data safe remains locked at all times and only authorized individuals have access. As part of our chain of custody maintenance, evidence drives and / or original hardware must be checked out through a specially designed evidence inventory database prior to any work being performed and then checked back in upon completion of any tasks.

Our Certifications

We employ only Certified Computer Examiners, all of which have completed numerous hours of training and passed practical examinations to acquire these certifications. We also have examiners who have earned tool specific certifications. Our ACE examiners have completed the required number of training hours and also passed a rigorous assessment using Access Data's Forensic Toolkit (FTK). In addition, our employees must also all be licensed private investigators in order to legally perform our services within the state of Texas.


If you have questions regarding digital forensics please call us today or contact your Elite Document Technology account manager to schedule a consultation.