Touchstone Forensics works with our clients to make balanced decisions on which data to capture, preserve and analyze. Throughout your case, we identify and prioritize key information sources to ensure that your resources are used wisely.

Every interaction with modern computer operating systems leaves trace information that can be recovered to reconstruct computer user activity, contents of documents and electronic communications . Many of these traces remain for months or years. Touchstone Forensics's certified forensic examiners, analysis methodology, meticulous attention to detail and information security expertise enable us to transform your raw trace data into admissible, actionable digital evidence while containing litigation costs and limiting business disruption.

Computer forensic examination can reveal
	Intentional data destruction (spoliation), including use of drive wipers and evidence eliminators
	Programs executed and times of execution
	Information transfer to external storage media, including USB drives, thumb drives, CDs, DVDs
	E-mail
	Instant messenger and chat logs
	Internet activity, including browsing history, viewed pages, login credentials and website cookies
	Document creation, access, revision, printing times and authors
	File creation, access, modification and deletion times
	Authentication credentials and passwords used for system access, e-mail access, websites, disk and file-level encryption

A typical Touchstone Forensics computer forensic examination consists of the following activities:

Evidence Acquisition Touchstone Forensics identifies and prioritizes the sources and locations of information that may be relevant to your case. Touchstone Forensics creates an acquisition plan that ensures all relevant case information is captured and minimizes the impact of this process to your normal business operations. Touchstone Forensics acquires and secures potential evidence properly to ensure the Chain of Custody is maintained for all evidence at all times. Touchstone Forensics allows you to maintain normal business operations throughout an investigation.	Typical Cases Computer break-ins and hacking attempts   Intellectual property theft   Divorce   Sexual harassment   Inappropriate Internet, E-mail usage   Industrial espionage   Breach of contract   Wrongful termination   Online stalking
Forensic Analysis and Reporting Touchstone Forensics accesses information that may appear to be destroyed, deleted, encrypted or password protected, including e-mail, electronic documents, web browsing history, online chat logs, images, document creation, revision timelines and more. Touchstone Forensics analyzes acquired information using special-purpose forensic analysis tools that identify pertinent findings, not mountains of unanalyzed data. Touchstone Forensics reviews evidence to determine information context and relevance and to identify leads for further investigation. Touchstone Forensics presents detailed and summary findings in a format that is usable by nontechnical personnel, attorneys, judges and juries.