Data discovery and indexing is a common need of law enforcement and corporations. One of the most common reasons for a forensic data recovery is to uncover evidence left behind after a crime or some form of wrongdoing. Unfortunately, most organizations have no idea how detrimental it can be to not have a complete forensic analysis run after a crime, theft or accident takes place. People are becoming more educated every day, and the methods used to hide and delete data are growing increasingly more sophisticated. If a device is used to commit a crime, it is very common to see hidden and obfuscated data spread throughout. This data must be recovered, and missing even one string of text could completely destroy an investigation, audit or intelligence gathering operation. Anybody can go through a data set and report on it, the difficult part is that no stone is left unturned. In many criminal cases, it is common for passwords, financial information, and other secrets to be stored in ways that are so obscure that it may seem impossible to find. We have spent years developing various tools to identify the presence of this hidden information, however in most cases automation is only a tool to assist in the manual forensic analysis of the data. If there is something to find, then we can guarantee it will be recovered.

• Simple indexing, organization and reporting of visible and deleted files

• Discovery and identification of hidden and/or encrypted partitions

• Basic cryptanalysis of encrypted data

• Automated and manual iteration of all raw data to identify hidden strings & files

• Manual iteration of images, audio files, binaries, etc... to identify associations or alterations

• Complete activity timeline construction for all available file system and network activities

• Automated indexing of activities on a device to form a digital paper trail

In our experience, cryptanalysis is one of the most complex and sophisticated services that any company can offer. The problem with encrypted data is that there is no magic bullet, some cryptography just can not be broken in a way that is economical to even the wealthiest organizations. Something as simple as getting data from an apple device can be more difficult that decrypting intercepted TLS packets from a major banking institution. Sometimes, the more simple something is, the harder it is to break. We can in no way offer a guarantee that cryptographically secure data can be broken using the resources we have available to us (or anybody else for that matter). What we can guarantee is that if there is a way to complete the task in an economical way, we will find it. Call us and speak to an expert for a detailed explanation of what results you can expect for a given task.

We also offer corrupted data integrity restoration using available information and/or an algorithmic approach to reconstructing the data if the corruption is small enough. Corrupted data can be restored using available parity information, ECCs & specific algorithms that help to identify data corruption and bring it as close to its integral state as possible.

• Identification and implementation of various algorithmic attacks on a given ciphertext or set of ciphertexts

• Discovery of potential faults and vulnerabilities in the implementation of the cryptography

• Key store and HSM attacks to reveal private keys.

• Brute force attacks using proprietary AI tools to greatly increase the probability of breaking a PBKDF passphrase

• Cold boot attacks & memory dumps of saved states to obtain keys when a flawed implementation is present.

• Development & modification of hardware and software to assist with live recovery of keys.