Begin by Booting the Suspect Computer with BitFlare
BitFlare must be booted from the CD on the suspect computer where relevant data may exist. Booting from the CD ensures that changes are not made to the suspect disk, potentially destroying critical electronic evidence. If relevant data are found, BitFlare will recommend that you go to the BitFlare Web site to purchase one or more Evidence Discovery Packs (EDPs). EDPs are electronic orders that enable BitFlare to search and extract the desired data to an external USB drive for preservation and further review. Because EDPs are carefully configured for your specific case, they must be purchased and downloaded from the Internet. Therefore, a second network-connected PC (other than the suspect computer) is required to complete the process. Isolation of the suspect computer is necessary to prevent destruction of potential computer evidence.
Purchase EDPs Only if Suspicious Data Are Found
EDP prices are based on the complexity of the search and extraction desired. Generally, the cost of an EDP will be only a fraction of the cost of hiring a forensic expert to obtain the same results.
SunBlock Computer Forensics Experts Are Available on Demand
SunBlock Systems is always available in situations where BitFlare alone is not the answer. If at any time, the user believes that the computer forensics investigation has become too complex or otherwise too critical for a non-expert, he or she can choose the Preserve Drive function to export all data on a drive for later computer forensic examination by SunBlock Systems computer forensics experts.