Forensic computer examinations go far beyond normal data recovery techniques, and go into areas and files on the media not normally accessed by untrained personnel.
These examinations can find the data ( E Mail, Internet History, deleted files etc) that the organization or client wants or needs. Forensic computer examinations are conducted using procedures and protocols that ensure all data that can be found is recovered and presented to the client.
There are 3 types of examinations available:
A Preliminary evaluation of 2 hours to determine whether further examination is available.
An Intermediate, limited examination of 10 to 20 hours for finding specific items of interest to the client. (the time may increase or decrease depending on the operating system, hardware issues, the number of hard drives encountered, the different types of media to be examined, password or encryption problems, the type of data encountered, or other specific examination requirements made by the client.
A Complete examination of 20 to 35 hours (which may increase or decrease for reasons similar to those mentioned above)