Understanding Your DataFerret Options
BEFORE you order...
Take a minute to answer the following questions: These answers will ensure that the DataFerret will work for you.
2. Does the computer to be captured have a standard 2.0 USB port? The DataFerret requires connectivity via this port. If it does not have the port, please contact AmDoc about other forensic services available.
3. Does the computer have multiple internal drives? The basic DataFerret is designed to capture the main hard drive of the computer it it attached too. If the computer as multiple internal drives, the Lab can customize the DataFerret to meet your capture needs. Please give AmDoc a call and speak to a DataFerret Representative (1-800-455-1599). Please note, the DataFerret is not designed to capture attached external drives.
WHAT are your service options with the DataFerret?
Capturing the drive is only step one of the DataFerret process. You must return the DataFerret to the Lab to retrieve the captured image. The DataFerret is not meant to be an archiving tool for the end user but a capture device which is returned to the Lab for further processing. Once the capture is completed, you have several extraction/storage options. You must select at least one extraction option when you return the DataFerret to the Lab. NOTE: If you are using the DataFerret to preserve data, you may opt for the Lab to store the image on your behalf for a specified amount of time. (See Additional Services below.)
Extraction Options:
| Option | Description |
|---|---|
| EnCase File |
Extraction and transfer the image to an EnCase File. This Option provides you a complete file set of all of the files on the computer. The extraction is provided in a standard EnCase E01 file format. |
| Specific File Type Extraction | If you are only interested in finding a specific file type, you can request extraction and transfer of just that file type. Your options include: All Emails All Spreadsheets All Graphic Files All Databases All Financial Files All Office Automation Files All Documents All Apparent Deleted Files |
Additional Services Available: In addition to the extraction services, we offer these additional services to assist with your collection.
| Service | Description |
|---|---|
| AmDoc Capture | Although the DataFerret is extremely user friendly, you may not be comfortable or have the staff available to perform the capture. AmDoc will be happy to provide a technician to perform the services for you. This can be done either onsite or the computer can be sent to AmDoc's Lab for processing. Please contact AmDoc directly if you desire this service. |
|
Extract Non-Apparent Deleted Files (Carve) |
This is the process of carving out non-apparent deleted files from the captured image. This is often used when malicious intent is suspected. |
| Culling using Search Terms | This is the process of reducing the number of files provided based on specific search terms. There are three (3) pricing options based on the number of terms provided. They include: 1 - 5 Terms; 6 - 10 Terms; Greater than 11 Terms. |
| De-NIST | This is the process of removing commercial software files from the image to produce only the user created files. |
| Customized Extract and Examination | This is a customized process of extracting and examining user created content for specific file type and file count by file type. You will need to provide specific criteria for the culling and review process. |
| DataFerret Storage | If the main intent of the caputre is for preservation, you may select this option to have the Lab store the image on their servers for a specified amount of time. You will be invoiced accordingly. |
READY TO ORDER, Please give AmDoc a call and speak to a DataFerret Representative (1-800-455-1599).