Recovering data from systems on which attempts to sabotage, hide, delete, overwrite or steal information have occurred including the following:

• Emails (including Outlook PST and OST files) - deleted, encrypted or in other conditions
• Databases, including proprietary customer information
• Documents, even those erased, sometimes shredded, or overwritten
• Keyword searches to find otherwise unrecoverable data
• Extract and analyze metadata ti show previous authors, revisions and other information embedded in documents
• Produce gallery of all or a select set of images found on the media
• Manual carving of otherwise inaccessible data
• History files and entries, including Internet history, or data copied from networks (network forensics) or digital media such as USB thumb drives, flash drives, memory stick
• Analysis of URL or web addresses manually typed by the user
• All email addresses and users
• Timeline rebuilding - chronological reconstruction of events on the device
• Produce and analyze instant message and other log files
• All images, including pornography, or images that have been hidden via steganography or encryption
• Spyware, Trojan and other malware analysis
• Log files of instant message and chat sessions
• Analysis of specific users’ activities including login dates and times
• Password cracking
• Analysis showing all software ever installed on the computer
• Analysis showing all external devices attached to the computer
• Manual rebuilding of MIME-type or other email attachments