Notes on Viewing Computer Search Results

Generally, you need a program that will open a particular document format. For example to view Excel spreadsheets you either need Excel or a program that will view the Excel file type. There are many free or low-cost file viewers available on the Internet.

A forensic computer image is an exact copy of the evidence hard drive. If files are damaged or corrupted on the evidence hard drive, they will also appear damaged or corrupted on the image and will be exported as such. I can attempt to decipher the contents of a corrupted file using computer forensics software. This can be time-consuming, however.

If you open a document on a read/write media (e.g. your hard drive) will can and probably will change certain date and time stamps in the file. One way to handle this is to burn the files to a CD or DVD and then view them.

Database files usually cannot be opened. They have to be queried. (Let me know, if you need to do this.)

Some files may be password protected. Passwords can be broken, but that can be expensive to do and there can be legal implications. Often there will be a file on the hard drive named “Passwords”. It will contain all the needed passwords.

I do not search for images without being asked to do such a search. Nevertheless, I may encounter pornographic images. If I encounter what I believe to be child pornography, I will advise you. Possession of child pornography is a Federal crime.

A note on searches:

            The searches are generally case-insensitive. They can be made case sensitive, however.

            Generally, we search for specific terms, for example searching for “type” will find type, genotype, typewriter, etc. Computers often store data without spaces, so occasionally the search will return what appear to be incorrect hits when letters have been stored together.

            I can also perform a different kind of search that does not rely on a specific term, but returns a particular class of expressions. Examples are:

            All valid email addresses
            All valid credit card numbers
            All valid telephone numbers

Photographs can’t be searched for content, except for a special case. I have software, developed to assist law enforcement in finding pornography, which will sort photographs by the amount of human shin color they contain. It works.

If Internet use is an issue, please let me know. Internet history can be reconstructed, but different software is used to do that. Some search results will be in the form of web pages; they are viewed using a web browser. Exercise care in actually visiting recovered web pages; you will load cookies and images from those sites onto your computer. I use an iPad to view such pages. I can then easily clear the cache, cookies and history from the iPad.