Electronic Data Evidence

Computer Forensics, E-Discovery Consulting and Expert Witness Services

Remote Imaging of Hard Drives

With our EDE Forensic Toolkit, it is now possible to image multiple hard drives remotely, i.e. we can connect to a PC thousands of miles away via the Internet, make a secure connection and image that drive at the remote location from our lab. We never have to touch any of the hardware or the image itself, and can even do file extractions, analytics, searches and responsive document culling, all remotely.

Here is how it works: We send you a CD or USB thumb drive with forensic software on it. You buy or we send you a portable USB drive to plug into the target computer whose hard drive is to be image-copied. After the target drive is booted from the CD (assuring a forensically defensible copy of the hard drive), a secure Internet connection between the two computers, your client’s and ours, is established via software on the CD. We acquire the image and save it to the USB drive attached to the remote computer.

Anyone on the receiving end can observe the mouse clicks we make and the software we use, so the entire process is transparent and safe. Since we never have possession of the hard drive or the image, this is an ideal solution for imaging drives with sensitive data, or even the opposing side’s hard drives, since we do not see any of the files that are image-copied.

The price for this? $199/drive image plus the cost of the USB hard drive.