PROTEGGA LLC Frequently Asked Questions

Computer Forensics

What is Computer Forensics?
Computer Forensics is the collection, preservation, discovery, analysis, and presentation of evidence found on digital devices. Computer Forensic Experts draw on a variety of methods for discovering, analyzing, and scientifically verifying information that resides on computer systems (Desktop, Laptop, MacBook), smart phones and cell phones (iPhone, Android, Windows Mobile, Blackberry), GPS (Garmin, TomTom, Magellan), Cloud Computing environments, other digital devices (iPod, iPad, NetBook, Tablet, MP3), and more.

What license does the State of Texas require?
In Texas, if a company engages in the business of securing, or accepts employment to secure, evidence for use before a court, that company is required to have a Private Investigator’s License, according to Texas Occupations Code Sec 1702.104. Private Investigation companies are overseen by the Private Security Board of the Texas Department of Public Safety. Click here to verify the license of Private Investigators and Private Investigation Companies. This applies only to Computer Forensics. E-discovery, Data Recovery, and Litigation Support are not licensed. Just be careful of the "thin grey line".

Who would need Computer Forensic services?
Any business or individual who needs to investigate the activities associated with the use of computers or other digital devices, especially if the other side has retained a Computer Forensic Expert. Computer Forensics is extremely valuable in litigation to support claims of embezzlement, fraud, intellectual property theft, and security and Human Resource policy violations. Criminal Law cases, both prosecution and defense, are dramatically enhanced with the recovery and/or dispute of computer evidence. Computer Forensics is even being utilized in family law cases with increasing regularity, as estranged spouses recognize the potential for evidence to support custody and divorce settlements.

Who can allow a computer to be searched?
The owner of a computer can grant permission for it to be examined. A business may grant permission for a search on any of their computers regardless of who uses it with some exceptions. In a civil dispute, the parties can agree to an examination or the court can order an examination. In a criminal case, the computer will usually be seized by law enforcement through the use of a search warrant. The defense can obtain copies of the seized items and any findings of its examination with certain exceptions.

What does a Computer Forensic Expert do?
At a high level, the Computer Forensic Expert copies, examines, and analyzes information, prepares a report, and substantiates findings in depositions and through expert testimony. The first step is to work with counsel to develop an appropriate strategy and determine the evidence needed to support the case. The next step is to collect and preserve the evidence. Finally, an analysis is performed on the collected data. Analysis may include keyword searches, timeline analysis, deleted file recovery, email analysis, and other tasks related to evidence identification and recovery.

What type of evidence can be found on a computer?
The answer depends upon the activities under investigation. Cases involving theft of trade secrets may focus on the recovery and analysis of all electronic communications, file copies, file print activity, access to CD burners, thumb drives, USB disks and more. Cases involving sexual harassment or wrongful termination turn to Computer Forensics to develop activity profiles such as email communications and Internet browsing habits.

Why use a Computer Forensic firm to evaluate digital evidence?
While you may have access to experienced IT resources, it is unlikely these individuals are trained in forensic protocols which can result in destruction and spoliation of evidence due to improper methods. The preservation, extraction, and analysis of computer evidence in a forensically sound manner requires access to specialized hardware and software and the knowledge to utilize these tools. Perhaps most important of all, Computer Forensics must be performed by an unbiased third party. Claims of evidence tampering or fabrication will be presented by opposing counsel in almost every case and a respected Computer Forensics firm can demonstrate forensically sound methods that are court-approved and impartial. As an Expert Witness, a Computer Forensics firm can provide opinions and conclusions relative to the findings.

How much does it cost?
Use care in your evaluation of costs. One of PROTEGGA'S clients had previously hired a respected Computer Forensic firm that charged an apparently reasonable rate of $250 per hour. However, this firm included all unattended computer processing time in their hours. The client spent over $70,000 for a job that should have been no more than $25,000. Another firm charged double time for any work performed with less than 24 hours notice. PROTEGGA adheres to the highest professional and ethical standards with costs always clearly defined. Ask the PMan for the current rate sheet.

Is Data Forensics different than Computer Forensics?
No. This is simply a marketing ploy. You may also hear it termed digital forensics. These are both identical to computer forensics.

How does Computer Forensics differ from e-discovery?
E-discovery is the process by which parties involved in litigation respond to requests to produce ESI, "electronically stored information". The production of ESI may be provided by a Computer Forensic Expert and there are definite benefits to having discovery performed this way. Computer Forensics is employed (1) to ensure all the information provided throughout discovery is accurate and complete, or (2) to perform a Computer Forensic investigation when discovery falls short of expectations.

Isn’t Computer Forensics just a data recovery effort?
This is a common misconception. Unlike ordinary data recovery efforts, Computer Forensic examinations use strict controls and procedures to ensure that all existing data is found, that the original data is preserved unchanged, and that any recovered data is admissible in court or other legal proceedings. Computer Forensic examinations are an investigative process and data recovery is only a very small part of that process.

What kind of data can be retrieved from the Cloud?
According to the National Institute of Standards and Technology (NIST): "Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction."

The term "cloud" is used as a metaphor for the Internet. That's it, the Cloud is really just a clever marketing ploy. The use of the Internet continues to grow with FaceBook, LinkedIn, Twitter, Blogs, Forum, YouTube, Television, eMail, data storage, Word Processing and Presentation tools, and more, and more applications.

If you use a computer to perform the work, there are remnants left behind. Coupled with the power of subpoena, we can find the evidence you need. Remember Locard's Principle, "Every contact leaves a trace."

What kind of data can be retrieved from Smart Phones?
This varies on the manufacturer and the OS version of the phone. We have successfully retrieved deleted text messages, eMails, voicemails, Internet history, photos, movies, and more from iPhone, Android, Windows Mobile, Blackberry, and other devices. Ask about your version.


e-Discovery

What is e-Discovery?
e-Discovery is the collection, review, and production of information stored in electronic format, "ESI" or "Electronically Stored Information", (e.g. emails and their attachments, spreadsheets, presentations, memos, reports, and computer-generated information, such as link files, registry entries, log files, configuration data, and metadata). To add to the mystery, e-discovery is also referred to as "ediscovery", "Electronic Discovery", "Digital Discovery", "ED", "EDD", "EED", "Electronic Digital Discovery", "Electronic Disclosure", "Electronic Document Discovery", and "Electronic Evidence Discovery".

How does e-Discovery differ from computer Forensics?
E-discovery is the process by which parties involved in litigation respond to requests to produce ESI, "electronically stored information". The production of ESI may be provided by a Computer Forensic Expert and there are definite benefits to having discovery performed this way. Computer Forensics is employed (1) to ensure all the information provided throughout discovery is accurate and complete, or (2) to perform a Computer Forensic investigation when discovery falls short of expectations.

How much does it cost?
Use care in your evaluation of costs for e-discovery. There are many techniques that can be utilized by e-discovery firms to initially hide some of the costs associated with their service. One firm bragged about making $750/hour utilizing an inflated per piece pricing. PROTEGGA adheres to the highest professional and ethical standards with costs always clearly defined. Ask the PMan for the current rate sheet.

What is Metadata?
Most people think of Microsoft Word and Excel when they hear the word metadata. In reality, metadata is much more complicated. See our whitepaper on metadata for a detailed explanation.

What stages of the EDRM Model can PROTEGGA assist with?
PROTEGGA is licensed by the State of Texas and can legally function in any area of the Electronic Discovery Reference Model including the analysis phase. Some firms have to be careful about crossing the line into computer forensics. Additionally, PROTEGGA has extensive Corporate Information Systems experience in a variety of industries and technologies allowing a much deeper understanding of where and how the information needed for your case could be stored.

What is EDRM?
EDRM (Electronic Discovery Reference Model) was created in May 2005 to address the lack of standards and guidelines in the electronic discovery (e-discovery) market; a problem identified in the 2003 and 2004 Socha-Gelbmann Electronic Discovery surveys as a major concern for consumers and providers alike.

The completed reference model provides a common, flexible and extensible framework for the development, selection, evaluation and use of electronic discovery products and services. The completed model was placed in the public domain in May 2006.

What about the updated Federal Rules of Civil Procedure?
Federal Rule of Civil Procedure 26(a)(1) requires disclosure of documents, data compilations and other tangible things that the parties may use to support their claims, defenses or damages computations.

Although FRCR 26(a)(1) requirements are seemingly straight forward, the process of identifying and locating responsive documents and data has become more complex as people and companies continue to shift their information transmission and storage functions from paper to electronic media.

Rule 26(f), planning conference, was modified to provide for a discussion of the issues related to electronic discovery, privilege assertion, and preservation. The following are examples of the types of issues and topics that should be discussed at this conference:

As a result of these changes and the increasing complexity of technology, attorneys must now frequently call on electronic discovery and computer forensic experts to assist in the preservation of electronic information at the outset of litigation, as well as in the gathering of documents responsive to Rule 26(a)(1) and other discovery requests.

(see Whitepaper – e-Discovery (The New Rules)) for more information.

What is spoliation?
Spoliation is the intentional or negligent destruction or alteration of evidence when there is either a current litigation, an investigation, or if there is a reasonable chance either may occur in the near future.

How many printed pages are there per GigaByte (GB)? per MegaByte (MB)?
This number will vary by the type of file and the particular characteristics of that file type. The secret to a good page estimate is the evaluation of the file types included in the set of data. The table below provides an average number of pages per GigaByte and MegaByte for some common document types.

Type Avg per GB Avg per MB
Documents 65,000 63
Spreadsheets 166,000 162
Presentations 17,500 17
eMail 100,000 98
PDF 25,000 24
Images 15,000 15

Although the actual number of pages cannot be determined accurately until the data is processed, it is possible to provide a rough estimate. When you don't know the data types, use an average of 75,000 per GigaByte or 73 per MegaByte.


Data Recovery

How much does it cost?
Use care in your evaluation of costs. Some firms get you in the door with the free diagnosis only to provide an outrageous quote for recovery. PROTEGGA adheres to the highest professional and ethical standards with costs always clearly defined. Take advantage of our "No Cost" diagnosis and Ask the PMan for a free recovery price quote with a "No Data, No Cost" guarantee.

What is Data Recovery?
Data recovery is the process of salvaging data from damaged, failed, corrupted, or inaccessible storage media. PROTEGGA is capable of recovering data from all types of devices: hard drives, RAID configurations, Servers, Laptops, Network Attached Storage devices, USB devices, and other external storage devices.

How can I prevent data loss?
Consistently backing up your data is the only way to prevent data loss. Accidents, mechanical malfunctions, file corruption, and viruses cannot be completely prevented.

What causes data loss?
Data loss is caused by a variety of different occurrences including accidents, virus, excessive heat, exposure to water, mechanical failure, file corruption, deletion, partition loss, and many others.

What type of storage media does PROTEGGA recover?
Our qualified technicians have salvaged data from all types of media including: hard disk drives, RAID configurations, CD’s, DVD’s, USB devices, flash drives, PDA’s, tapes, phones, and digital music devices.

How long will it take to recovery my data?
The answer to this question is specific to each case. A typical logical recovery could require only 1-2 days for full recovery; however, some cases can take up to a week or more.

How will my data be returned to me?
Data recoveries of less than 8 GB will be returned on a thumb drive to the client. For any recovery of more than 8 GB, PROTEGGA will either use a storage media device provided by the client, or if none is provided, an external USB storage device will be provided at an additional expense to the client.

Is my case and data confidential?
PROTEGGA respects the complete confidentiality of every data recovery that we perform. Confidentiality is guaranteed from the moment the storage media arrives at our office.


Litigation Support

What is Litigation Support?
Litigation support is the process of providing consultation and support services to attorneys in relation to current and pending cases. The type of support services provided will depend on the needs of each individual attorney or firm, but may include Document Scanning, Blowbacks, OCR Conversion, CD/DVD Duplication, Printing and Binding Services, Audio/Video Conversion Projects, Trial Graphics, and other forms of Technical Consulting.

How much does it cost?
Watch for extremely low introductory pricing. Know your real costs up front. PROTEGGA adheres to the highest professional and ethical standards with costs always clearly defined. Ask the PMan for the current rate sheet.

What is an image?
For the purpose of litigation, an image is digital photocopy created by scanning a paper-based document or by printing an electronic document to an image format such as TIFF or PDF.

What is a TIFF image?
Tagged Image File Format (abbreviated TIFF) is a file format for storing images. The TIFF format is the standard in document imaging and document management systems using CCITT Group IV 2D compression. In high-volume storage scanning, documents are typically scanned in black and white to conserve storage capacity utilizing about 50 kB of storage at 300 ppi.

What is a PDF file?
Portable Document Format (PDF) is a file format created by Adobe Systems in 1993 for open document exchange. PDF was officially released as an open standard on July 1, 2008, and published by the International Organization for Standardization.

There are three types of PDF files:

What is OCR conversion?
Optical character recognition, more commonly referred to as OCR, is an electronic translation of images of handwritten, typewritten or printed text into searchable, or editable, text. While perfect translation would require human intervention, high-quality images can produce up to 95%-99% accuracy. Documents produced by a laser printer with standard fonts on white paper would likely produce high-quality images when scanned.

What does blowback mean?
In the civil litigation discovery process, documents are often produced between parties on CD or DVD because the cost of production and delivery of documents on disk is so much less than production and delivery of paper. When these documents are printed, or returned to paper form, it's called "blowback".

What is coding?
Coding is the process whereby an individual examines an image of a document and populates the fields of the case database. The term “auto-coding” refers to a software process of using OCR to populate fields in a database. While improving, this technology is only appropriate for certain document collections where time is a major concern.

Objective coding is a relatively simple process of examining a document and filling in database fields with searchable and sortable information about the document. Objective coding does not necessarily require familiarity with the particulars of the case.

Subjective coding requires a deeper understanding of the issues in the case in order to properly identify hot documents and those which will cause issues as the case progresses.

How much data will fit on a CD? DVD?
You can fit approximately 18,000 letter-sized, 300 dpi black and white images on a single CD; about 6 case of paper. Depending on the file format, you can expect approximately 75,000 pages of native electronic documents on a single CD; about 25 cases of paper. Almost 7 times that will fit on a single layer DVD. With the advent of Blu-Ray, you can save a forest.


General

Why are your rates lower than others in this field?
PROTEGGA desires to have Computer Forensics, e-Discovery, Data Recovery, and Litigation Support services available to everyone, not just those blessed financially, while providing the same, or greater, expert level of service available anywhere.

How were your rates determined?
Utilizing the following factors and 20+ years of experience, PROTEGGA has set rates that are fair to everyone involved.

What forms of payment do you accept?
PROTEGGA accepts checks, cash, MasterCard, and VISA. Given the right situation, we have provided payment plans as well.

What geographic areas do you serve?
PROTEGGA has been aiding attorneys, individuals, and corporations involved in Civil Litigation, Family Law, Corporate Bankruptcy, Employment Law, Mergers & Acquisitions, and more since 2003. PROTEGGA proudly serves Texas and the United States from our North Texas office in Plano (a suburb of Dallas). In addition to the courts listed below, PROTEGGA has served as Computer Experts in State and Federal courts in Texas, Utah, California, New York, Florida, Oklahoma, and others.

Where Have PROTEGGA Experts Worked?

How do I file a complaint with the Private Security Board?
Hopefully, your issue is not with PROTEGGA, but rather with another firm. In any case, if we, or another firm, have failed to resolve your issues, here is the contact information for the Private Security Board. Please include the name of the firm and the license number in any correspondence with the Private Security Board. For PROTEGGA use, PROTEGGA LLC Texas License #A13971.

Private Security Bureau
By mail – PO Box 4087, Austin, TX 78773
By facsimile – 512-424-7729

Where should I go to serve a subpoena on a PROTEGGA employee?
Hopefully, you have contacted PROTEGGA before going to the trouble of a subpoena. We are in the business of appearing at depositions, hearings, and trials and always try our best to accommodate everyone's needs, regardless of who's paying the bill. If you still need to serve us, use the address below.

730 E. Park Blvd
Suite 210
Plano, Texas 75074