FAQs
| ASSET RECOVERY |
Will I get any return on my materials?
In most cases yes, depending on the volume, condition and recyclable content found within the equipment. All equipment received is properly sorted, and items found with significant re-sale value will be shared with the customer.
How do I earn return on my previous investment?
You consign your equipment to us, retaining title until we locate a buyer and complete a sale. You may request the return of any equipment as needed. When equipment is sold, the proceeds are shared proportionately. As our Investment Recovery partner, you are guaranteed payment once the equipment has been sold, since we bear all risk relative to any collection issues that may arise.
Am I required to recycle?
The disposal of electronic scrap is monitored by the Federal Resource Recovery, and Conservation Act (RCRA). Computer recycling is also regulated by the Federal Environmental Protection Agency, because our environment can be harmed by the release of certain electronic components found within computer and monitor scrap, particularly lead.
Data Wiping
If I have sensitive data on my hard drive, what should I do?
Most large organizations have established procedures for decommissioning old computers that include removing or wiping the hard drive. Dealing with a large number of systems could be costly when you add up the labor hours required to remove the drive from each machine. There are companies offering to deliver certificates of destruction to alleviate the IT staff from this task and, in some circumstances, actually save money.
Why is it insufficient to format or delete partitions containing files with confidential data?
Formatting of a hard disk partition does not affect the data written on the sectors of a hard disk in any way. Formatting just creates the data storage structure on a disk; this is known as a file system. If you just format a hard disk drive partition, only the names of files registered in the File Allocation Table will be destroyed — your confidential data will remain in sectors of the hard disk.
Is your company trying to make a little money by selling off its used computers? Or is it trying to do a good deed by giving them away to charities?
Formatting a hard drive alone becomes insufficient due to the widespread availability of cheap data recovery utilities. The same holds true for those that simply remove partitions. While this operation will make the data appear to vanish, the information is actually very, very recoverable.
| COMPUTER FORENSICS |
How is it possible to retrieve deleted evidence?
A computer's operating system uses a directory that contains the name and placement of each file on the drive. When a file is deleted, several events take place on the computer. A file status marker is set to show that the file has been deleted. A disk status marker is set to show that the space is now available for another use. While the user can no longer see the file listed in any directory, nothing has been done to the file itself!
If the user has defragmented or reformatted a drive, can evidence still be retrieved?
Many pockets of information are not altered by "defragging" a drive, because many documents contain internal information that describes dates, users, and other historical data that may be useful to the case. And while reformatting a drive rebuilds the file system, it does not remove the information that previously existed on the drive. Our computer forensics specialists, who have the right software and experience, can recover most of what was on the disk before the reformatting process took place.
As an attorney, what should I do if I suspect that evidence may exist on a client's computer?
First, curb your curiosity! Repress your natural tendency to want to check it out. Remember that simply starting the computer changes files; many of those changes affect significant dates, and any access to the disk risks overwriting pertinent information and destroying the chain of custody. Do your best to ensure that the computer remains untouched until one of our qualified forensics specialists can create a certified, bit-by-bit copy of the drive(s). The image can then be examined without jeopardizing the investigation.
What risks are there if I don’t consult a Computer Forensics expert at the start of a problem?
The most frustrating aspect of forensic analysis is that the operating system randomly overwrites data on the hard drive. This means that the longer a computer is used, the more likely it is that evidence will be lost. Fortunately, the operating system frequently records evidence in several places simultaneously. So if the data is overwritten in one area, it may still reside in another. It is impossible to tell, however, whether the data that is most important to you will survive the constant use of the computer. Indeed, the simple act of turning the computer on or looking through files can potentially damage the very data you’re looking for. The dates that files were created can be changed, files can be overwritten and evidence can be corrupted. The safest practice is to acquire an image of the computer as soon as possible; however, it may be possible to find relevant data even after years of use.
If I think that evidence exists, is it ok if my technology expert looks for the information before I get in touch with a Computer Forensics Expert?
Companies that fall victim to computer crime may inadvertently destroy evidence in their efforts to find the perpetrators. You only have one opportunity to collect the evidence. You need to prove your case. IT staff inexperienced in computer forensics can ruin evidence even if they understand their systems inside and out. Computer forensics specialists follow specific analysis and chain-of-custody protocols required by courts.
How do I figure out the ROI (Return on Investment) on contracting Computer Forensic Services?
If you are thinking about performing this type of work yourself or using your corporate IT department or local computer technician, consider the internal dollar cost, the possibility of your evidence being tossed out because of the method in which it was acquired, the qualifications of those who worked on it, and personal or business associations your staff might have with the subject.
The internal cost is not only the time you or other people spend performing this work, but also taking them away from their assigned responsibilities and the time spent in writing reports (a 40 GB hard drive can have over 9,101,420 pages of data), possible Interrogatories & depositions, other internal issues, gossip spreading and loss of work productivity. All these may occur and can affect you, your business and most importantly—the outcome of your case or situation.
Does Function5 perform On-Site Evidence Gathering?
Function5 Forensic Services offers an “On-Site” Service for gathering information. Should a covert service be required, one of our Forensic Service Specialists will arrive On-Site and image the hard disk drive, server, or other storage device (after hours, if required). The benefit of this service is that the subject is denied the opportunity to destroy or damage any of the evidence or alert fellow conspirators. Our trained professionals are able to lift and securely transport all required equipment. When necessary all of the forensic investigation can be carried out at the client’s site.
| DATA RECOVERY |
What is Function 5’s data recovery process?
Step 1. Function5 takes possession of the computer/storage device
Step 2. Determine if the problem is logical (software structures) or physical (hardware).
Step 3. If logical, any recoverable data can typically be recovered within 3 business days. If we are unable to recover any data,
there is no fee. If physical, we approximate the amount of the data that can be recovered and provide an estimated cost, within
5 business days.
If my device is non-working, does Function5 have Clean Room service?
Yes.
Our clean-air facilities provide controlled temperature and humidity and particulate filtration to protect all recovery equipment and client media from contamination. Our clean-air facilities undergo annual certification testing to ensure that they meet or exceed acceptable air flow uniformity and particle count standards. For devices that need to enter the clean room service we offer Priority and Economy Services to get your data back to you.
Are there instances where lost data cannot be recovered?
Yes.
There are instances where the damage to the hard drive is so severe that data recovery is not possible. This usually occurs when the read/write heads actually "crash" and gouge the magnetic storage medium to the point where the data is destroyed.
However, in a number of cases data recovery was possible at the time the damage first occurred, but became non-recoverable through the use of commercial recovery software. This software is designed to recover data from working drives. If your drive has experienced a mechanical or electrical failure, the use of recovery software can cause permanent loss of your data.
My documents contain confidential information. How can I be sure they will remain confidential?
Function5 offers clients a secure environment so that you can rest easy knowing that your information is kept private. Every member of our team is under non-disclosure. The evaluation and recovery process is conducted in secure labs with controlled access to ensure the confidentiality of your data.
We have unwritten non-disclosure agreements with all of our customers, but if your legal department requires a written agreement it should be faxed to the nearest office for processing.
| HARDWARE PRODUCTS |
What are the advantages of pre-owned hardware vs. new hardware?
Function5 provides both new and pre-owned hardware. There are some advantages of buying pre-owned hardware. Click here to view them.
What is a firewall?
Firewalls are computer resources configured to allow "good" traffic in and to keep "bad" traffic out. They must be updated continuously to support changing business requirements such as new users, employee status changes, new partners and new applications. Firewall management is resource-intensive and requires a high level of skill. Because of the effort and complexity involved, most firewall breaches are caused by the mis-configuration of firewall rules and policies.
Has someone intruded upon your network?
We have been approached by some large corporations asking for our help in identifying traces left behind by hackers. Some of the critical information needed was: what port was victimized, what was the method of attack (e.g. which virus or Trojan), and most importantly, how bad was the intrusion? We have even been successful in finding the hacker tools that were deleted by the unauthorized visitor.
How can I protect my network and its resources from hackers?
Install a firewall. If you connect your LAN directly to the Internet, configure a firewall to screen both incoming and outgoing traffic. Not having a firewall is the equivalent of going on vacation and leaving your windows open for someone to break in. This also includes employees going out to unauthorized destinations.
Am I really in any danger of someone hacking into my network and getting my company’s sensitive information?
Yes, there can be no question that you're in danger.
If your computers are only connected to the Internet briefly, when you're browsing the web or retrieving and sending email, your connection exposure will be minimal. But if you are one of the millions of people who are discovering the amazing power and convenience of a persistent connection to the Net, and if you leave any of your computers on and connected for hours at a time, then your exposure is substantially greater.
Hardware Maintenance
How much can I save by getting a third party contract?
It varies. The prices are negotiable. On volume contracts you could get up to 85% off the list price from the OEM.
What are the advantages of a hardware maintenance contract?
You do not have to pay for parts or labor every time that the computer breaks down.
The computer is fixed by a technician and you do not have to spend time resolving this problem.
The annual costs are fixed costs and therefore can be budgeted. There are no surprise expenses for emergency repairs.
What are the advantages of using a third party maintenance company?
Low maintenance prices.
A third party company can support equipment from different manufacturers and can assume responsibility for multi-vendor problems. It is better to have only one maintenance contract instead of multiple contracts.
Hardware Repair
What happens if the hardware fails after the warranty expires?
You have a problem and you are on your own. Here are some of your options:
Fix the hardware
yourself if possible. Pay a company
to repair the hardware. Replace the entire
system. Stop using the
system.Should I replace the hardware instead of repairing it?
If the hardware is inexpensive, it may be better to replace it rather than to repair it.
However, if equipment that costs hundreds of thousands of dollars fails, it cannot be easily replaced and should be repaired.
If a new replacement system is not very expensive, say less than $8,000, and if it comes with a three year warranty, you should compare the following:
How much would
a maintenance contract cost for three years. How much would
a new system with a three year warranty cost.