Experts in Electronic Discovery & Digital Forensics - Company Message
Efficient and effective Electronic Discovery & Digital Forensics begins with the preservation of Electronically Stored Information (ESI). For both large & small businesses, preserving ESI should be a routine, prophylactic action conducted prior to litigation as part of an information management plan. Unfortunately, preservation is most often employed on an irregular basis in response to discovery requests during civil litigation. As a result, critical metadata (the properties & attributes of a file) is often lost - most often due to changes in the status or condition of a file itself. 

In criminal matters, preservation of digital evidence is the responsibility of law enforcement. Mr. Penrod most often conducts criminal defense examinations at law enforcement facilities. When contraband images are not part of the evidence, law enforcement will normally produce copies of the digital evidence in discovery to Mr. Penrod for examination at his lab.

Regardless of one's situation, from the initial design of a plan to preparing for trial, PenrodEllis FDD can help.
 
 
The certified computer examiners at PenrodEllis FDD of Denver, Colorado are experts in the forensic collection of ESI from computers, mobile phones and other electronic data storage devices. We preserve and safeguard the integrity of electronically stored information. Authenticated forensic bit-stream images are the basis for e discovery as well as forensic computer examinations and network security investigations. It is from forensic images that computer evidence is recovered.
COMPUTERS & OTHER DIGITAL ELECTRONIC DEVICES
PenrodEllis FDD can extract mathematically authenticated forensic images from the digital devices listed below. For more information about them, click HERE.
 
Computers, such as network servers, client workstations, & personal desktop/laptop computers

Storage Devices, such as hard-disk & solid-state drives, removable USB keys & flash cards, portable & desktop USB drives, & network storage arrays

Mobile Devices, such as smartphones, mobile phones, tablet computers, & e-book readers
 
Network Devices, such as Internet modems, unified security gateways, network routers, & WiFi access points
 
Multimedia Devices, including digital cameras, video recorders, & music players
 
Television Appliances, such as cable & satellite DVRs, & streaming video players
ELECTRONICALLY STORED INFORMATION
PenrodEllis FDD can examine the following types of Electronically Stored Information (ESI). Click HERE for more information. 
 
File systems, such as FAT32, NTFS, HFS+, APFS, & HPFS

Operating systems, such as Windows, MacOS, Linux, Android, & iOS

Active & Latent ESI, including file content (data) & properties (metadata), as well as intact & partially overwritten deleted, temporary & discarded files 
 
Office Documents, such as word-processing files, spreadsheets, presentations, & publications
 
Electronic Communications, such as email, chat, & text messages
 
Internet Access Records, such as web browser databases & P2P client files
 
Logs, which include system event, user activity, file usage, & audit trail records
PenrodEllis FDD of Denver, Colorado forensically recovers ESI in e-discovery and digital forensic cases from  the forensic image and not the originating source of the ESI.
Forensic examiners preserve ESI by extracting authenticated forensic bit-stream images from the storage components of computers, appliances, & external drives. Forensic imaging captures all active & latent ESI on storage media. A forensic image (often called a mirror image) preserves that ESI as it existed at the time of its extraction & safeguards its integrity. A mathematically verified forensic image is the foundation that establishes recovered data & metadata as legal evidence. Courts throughout the world accept forensic images as authentic representations of the original ESI on a storage drive, allowing experts to submit evidentiary ESI in hearings and at trial. For this reason, forensic recovery of ESI is only rarely conducted against "live" computer systems and storage devices. The forensic bit-stream image is the only source of computer evidence presented at trial.  

 
PenrodEllis Forensic Data Discovery
200 South Wilcox Street, Suite 327
Castle Rock, Colorado 80104
(303) 945-6006