How does T3i DTL access the information on my computer?
How the information is collected depends on the situation. In cases where chain of custody is of paramount concern, a team from T3i DTL will respond to the computer location and collect the information by making a forensic copy of the computer storage. Other cases allow for the computer to be shipped directly to T3i DTL lab in Atlanta. Where down time is unacceptable, the acquisition of the computer information can be done after hours and on-site. State of the art forensic imaging software and hardware are used to reduce the average on site time to a few hours. We can usually tell what a computer was used for, when it was used, what the user has done on the Internet (and when), and recover much of what the user wrote, read or viewed on the computer.
