Why do I need ProDiscover® Investigator to conduct internal investigations?
A. Standard applications, when used to examine a system for evidence of criminal activity or violations of corporate policy, have three basic problems. First, they can be miss data which has been deleted or hidden in areas such as the Hardware Protected Area, Alternate Data Streams or disk slack space. Second, standard applications will alter valuable metadata such as last time accessed, and thereby destroy valuable evidence. Third, the data gathered by these tools is not evidentiary quality and may not hold up in court. ProDiscover® Investigator will find all the data on the disk, will not alter any data or metadata, and provides hash signatures of the files for proof of authenticity in legal proceedings.
