|
| |
Frequently Asked Questions
 | Your competitors don't give details of their
expertise or their rates on their websites, why does RTSI?
We've been in the computer forensics business longer
than most other companies in the United States; we believe in being upfront about everything. We know that your time is
valuable and don't want to waste it. Putting the information on the website
allows you to decide upfront, without having to call or email for
information, whether we are what you are looking for.
Many companies advertising computer forensics services
don't have any qualified staff to perform the services. Instead, they
subcontract your engagement with another company. Other companies are trying
to get started in what they view as the profitable world of computer
forensics; they are looking for you to bankroll their on the job training.
Neither of these types of companies have any qualifications to put onto
their websites.
While anyone can buy computer forensic software and take a class to learn
the basics of using it, becoming a proficient examiner, much less an expert,
requires many years of experience. |
| Why are "Company XYZ's" rates so much cheaper
than yours?
Most competent computer forensic examiners charge between $200 and $400 per
hour. Companies that are charging significantly less typically do so because
they lack the experience to be able to charge the standard rates. As with
many things in life, quality costs more.
Frequently, these examiners have purchased a single piece of forensic
software and possibly taken a class to learn its basic use. True forensic
examiners will have a vast number of forensic tools available and will have
been to many training classes.
|
| Why should we choose you to examine our computer?
We have years of experience in the recovery of computer data, computer forensics, and
computer related investigations. Our clients include corporations of all
sizes, as well as state and federal agencies.
We regularly provide expert testimony in state and
federal courts concerning computer forensic examinations. We provide training to law
enforcement officers (city, county, state, federal, and military) around the country in
the investigation computer crimes and computer forensics.
Mr. Rehman is serving his seventh term as the President of the Florida Association of computer Crime
Investigators (FACCI). Approximately 75% of FACCI members are law enforcement, government,
or military investigators; the balance is made up of computer security professionals and
corporate security professionals. FACCI enjoys a worldwide reputation for providing
cutting edge computer crime and forensic training.
We are the ones that other forensic
examiners turn to for assistance. If it is important enough to
use computer forensics, it is critical to
use the best. |
| You're in Florida, wouldn't it be cheaper to get
someone who is local?
We have clients throughout North America and Europe. Most of our cases
never require any travel; the client ships the hard drive(s) to us.
In civil cases, we frequently find evidence causes the other side to seek settlement.
The most important factor in selecting a computer forensic examiner
shouldn't be geography. There are a very
limited number of truly qualified firms across the
United States in the computer forensics field. Many of the major cities in
the U.S. don't have any qualified individuals in the private sector.
Hiring the best qualified examiner may cost more initially, but is there any
value in an incomplete examination? Only the best examiners can provide
thorough examination and interpretation. |
| We have computer personnel in our company, why shouldn't we let
them conduct the examination?
Although they may have a considerable amount of knowledge and experience with computers,
perhaps even data recovery, it is highly unlikely that they have the requisite knowledge
of the forensic protocols that must be observed to find all of the evidence, protect the
data, and ensure the admissibility of evidence in civil or criminal trials. We take steps
to safeguard the computer data; these steps require specialized training, hardware, and
software. We have the training, experience, and tools to conduct a thorough examination of
computer data and are able to interpret what we find.
In addition to the lack of skills, hardware, and software, using a company employee can
open you up to allegations of fabricating evidence and other impropriety. We are an
independent firm and integrity is the keystone of our company.
Can your employee qualify in court as an expert in the forensic examination of a computer?
Probably not. Assuming their findings were not suppressed, they would only be allowed to
testify to facts. They would not be allowed to testify to opinions or conclusions. Our
expertise has already been recognized by state and federal courts around the country.
We often receive computers to examine after
a company's computer personnel have attempted to recover evidence from it.
In their attempts they have destroyed important evidence such as the date
that files were last accessed. The forensic processes and hardware that we
utilize are designed to safeguard every bit of evidence. |
| We don't plan on going to court. We're just looking for what an
employee has been utilizing a computer for. Isn't it ok to use in-house computer personnel
to do this?
If your concerns are strong enough to warrant the examination of a computer, then it is
important to do it right. If the employee is fired or disciplined as a result of the
examination, civil litigation will likely follow. We can provide you with the
documentation and expert testimony that are necessary to substantiate your actions. Our
vast experience allows us to not only find the evidence, but to interpret its meaning. |
| We are working with a Private Investigative company. Why can't
they examine computers for us?
While there are many tens of thousands of Private Investigators around the country, the
examination of computers is far beyond the skills and training of all but an extreme few.
There are many specialties in Private Investigation; just because an investigator has
excellent credentials for conducting financial investigations does not mean that they are
qualified to examine computers. If you are going to pay someone to recover computer
evidence, pay a professional examiner. With our expertise and tools, we can recover
evidence that others wouldn't even know to look for. |
| Can we use a data recovery firm for doing computer forensics?
Some data recovery firms may have qualified forensic examiners; most probably do not.
While some of the same skills and software are used in both computer forensics and data
recovery, computer forensics requires extensive additional knowledge and experience.
Remember, a forensic examiner is not only finding the data, but is also providing expert
analysis of what they find. This expert opinion must be capable of standing up under
intensive cross-examination. Likewise, you need to know the qualifications of the
person(s) that will actually perform the examination rather than the collective
qualifications of all of the examiners at the company. When it comes time for testimony,
the individual examiner's qualifications, not the company's, will be under scrutiny. |
| We already have a relationship with
a major accounting firm that says they can do computer forensics. Why can't they
examine computers for us?
There are some excellent forensic examiners working for the
major accounting
firms. There are also some unqualified individuals being passed off as
qualified. As with a data recovery firm or any other firm, the qualifications of every
individual that will be involved in your case must be known in advance. |
| What qualifications should we look for in a computer forensic
examiner?
There is an ever increasing number of people hanging out their shingle as computer
forensic examiners. Some are among the most qualified individuals in the country; others
are opportunists, lacking expertise, who believe they can make fast money. Some factors to
consider include:
|
- How long has the examiner been doing
computer forensic examinations and how many have they done? If your
situation is important enough to require computer forensics, it is important
enough to not entrust it to someone who has just taken a course or two and
has very little practical experience.
- Is the person a former law enforcement, government, or military
examiner? (Note: not just a former member of one of those organizations, but someone that
actually did examinations for the organization.) The best forensic training
was
historically only available to these groups. Examiners in this group have been
trained in proper evidence handling and documentation. They are accustomed to operating at
a proof level of beyond a reasonable doubt. They are also
more likely to have a greater amount of courtroom experience.
- While computer forensics requires the ability to think
logically, it also requires investigative instincts. Examiners that are
former law enforcement investigators have honed these skills. An examiner
that does not have an investigative background may think logically, but
probably lacks the investigative instincts.
- Has the person been accepted in court as an expert in computer
forensics? How many times? Federal Court? Can they provide references by attorneys as to
their testifying abilities? Has their expertise withstood appellate review?
- Are they a member of any computer forensic related organizations?
These include: Florida Association of Computer Crime Investigators (Mr. Rehman is
President of this organization); High Tech Crime Network;
High Tech Crime Investigations Association (Chapters
nationwide); International Association of Computer Investigative Specialists (provides
forensics training only to law enforcement- only people trained by IACIS can belong);
Computer Forensic Information Digest (an email
list); and Forensic Association of Computer Technologists (upper Midwest). These
organizations provide cutting edge information that is necessary for any true forensic
examiner to stay current.
- Another issue is the forensic processing software used
by the examiner. Some firms, including at least one of the larger ones, are
using dated analysis methods that result in their examinations taking
significantly more time than firms using state of the art methods. Greater
examination times mean far greater costs to the client.
- Verify claims of experience; there are many
charlatans claiming to be experienced computer forensic examiners. When you
look closely at their claimed training and experience, you quickly find that
they have grossly exaggerated their limited, or even non-existent,
qualifications.
| What does it cost?
We charge $300/hour for forensic analysis and require a $5000 retainer for ordinary cases
(a single PC or Mac with an 80 gigabyte hard drive). An average examination
generally takes a minimum of 30 hours, though this can vary greatly
for any given
situation. Factors that effect the amount of time required include: the amount of data to
search (i.e.: hard drive size, number of CD's, etc.); volume of
material; encryption; data hiding; and
attempts as destroying the data. Call us for more details; there is no charge for the
initial consultation. Our Rates, Terms, and Standard
Agreement are available by clicking on the link below the next FAQ. |
| Why do you require a $5,000
nonrefundable retainer?
We are often asked to perform less than a complete
analysis or to limit our hours in an effort to minimize the cost. We cannot
honor these requests because we will not conduct less than a thorough
analysis. Doing so shortchanges the client: all of the evidence sought is not
found because insufficient time is allocated to the examination. It also
places our reputation in jeopardy: if we do not find evidence that is present,
it reflects poorly on us, even though our client asked us to limit our hours.
In our experience, the thorough examination of a computer is going to take at
least 20 hours. If the potential client is not willing or able to invest this
minimum amount, we are probably not the correct firm for them. |
Click here to see
Our Rates
and Standard Agreement
|
