How Do You Recover Lost Data from Digital Devices?

Our computer scientists use write blockers to create "forensic images" (copies of entire hard drives or other non-volatile storage) while preserving the integrity of the original drive and supporting the retrieval of assets such as files, folders, voicemails, texts, apps, app metadata, and lower levels of data without affecting the as-is condition of the devices.

Exponent digital forensic experts analyze forensic images using court-recognized software and custom scripts to locate files that are often hidden, deleted, or overwritten during day-to-day computing, such as emails and audio/video data.

Mobile phones and consumer electronics store information in many forms locally or in the cloud. Local storage on consumer electronics can include on-board flash memory or other non-volatile storage, while cloud storage at data centers uses similar hardware or larger-scale storage media. Computer scientists can extract forensic artifacts such as apps, texts, phone calls, data downloads, and app database files from mobile phones via well-known software tools and from hardware using bespoke scripts for the target storage medium.

Our teams extract videos that are ostensibly "deleted" and partially overwritten using industry-accepted software and video reconstruction tools along with binary file signature data.

Exponent's clients have faced challenges in court over the production of digital evidence. The provenance and integrity of digital evidence may be difficult to establish in some cases, for example, where malicious operators may have used data processing tools to modify image or video data manually or using Generative AI. Exponent's digital forensics team collaborates with statisticians and data scientists to identify signatures in source code, algorithms, file data, and metadata to answer questions such as "Has this been modified?" or "Is this AI generated?"