What Is Computer Forensics?

Forensics refers to latent evidence which may be in the form of DNA, blood, fingerprints or electronic data.

Computer forensics combines the element of law and the element of computer science to properly acquire, analyze and present electronic evidence to the courts. The primary purpose of computer forensics is to maintain the integrity of evidence by properly identifying, preserving, analyzing and presenting that evidence using industry standard methodologies and procedures.

Computer forensics may be performed on any media that contains electronic data such as computers, cell phones, removable storage media (ie: thumb drives and CD-Roms), gaming consoles, digital cameras, security systems, scanning and copy machines, etc.

Computer forensics and electronic evidence are relatively new concepts in the realm of civil and criminal law and rapid advances in technology are outpacing the knowledge and experience of those working in the legal industry. As such, legal precedents and practices are continuously being established, challenged and modified.

About Us

Loehrs & Associates, LLC (formerly Law2000, Inc.) was established by Tami Loehrs in 1999 as a computerized litigation support company providing IT support services, computerized litigation services, e-discovery and computer forensics services. As the computer forensics division became increasingly demanding, Law2000 sold the other divisions and focused all of its attention on the field of computer forensics. In addition to the new name, Loehrs & Associates purchased a new building with a state-of-the-art forensics lab and room for expansion.

Loehrs & Associates has built a reputation of providing exceptional computer forensics services with proven results. We have worked with hundreds of individuals, corporations, private attorneys, Federal Public Defender offices and other state and county defender offices throughout the United States, Puerto Rico and Canada. Our work has resulted in favorable results for many of our civil and criminal clients including settlements, plea bargains and dismissals.

For additional information regarding our forensic examiners, visit the Biographies section of our website.

Loehrs & Associates offers experienced and professional computer forensics services on civil, criminal and personal matters involving electronic evidence throughout the United States and Canada, including, but not limited to, the following:

  • Bad Faith
  • Bombing
  • Breach of Contract
  • Burglary
  • Canned Spam Act
  • Child Pornography
  • Domestic
  • Dram Shop
  • Drug Trafficking
  • E-Mail Fraud
  • Employment
  • Harrassment
  • Homicide
  • Intellectual Property Theft
  • Kidnapping
  • Medical Malpractice
  • Mortgage Fraud
  • Network Intrusion
  • Sex Trafficking
  • Unauthorized Use of Computer
  • Violating Terms of Agreement
  • Wire Tap

What We Can Do For You

-Acquisition
As soon as electronic data becomes possible evidence in a legal matter, it is imperative to preserve that data. This is done by making a “bit for bit” forensic image to preserve the data’s integrity.

Loehrs & Associates can acquire electronic data from a variety of media with a variety of options. Original evidence may be shipped to our lab to be acquired and stored in our evidence safe, or we may travel to the site where the evidence resides. In certain situations, we may acquire the data in a live-state so as not to disrupt business operations.

-Forensic Analysis
The forensic analysis of electronic evidence is an investigation into what occurred, when it occurred, how it occurred and who may have been responsible for the occurrence. This analysis must be done pursuant to industry standard methodologies and procedures using forensic tools that have been tested and approved. Electronic evidence may exist on devices such as hard drives, flash drives, CD’s, DVD’s, cell phones, memory cards, gaming systems, GPS devices, security systems and other forms of electronic media. Electronic evidence includes data that is easily accessible as well as data that may not be accessible such as data that is compressed, encrypted, hidden or deleted.

Loehrs & Associates offers thorough, in-depth forensics analysis of electronic evidence on any form of electronic media using industry standard tools, methodologies and procedures. Through our in-depth analysis we can provide an accurate portrayal of what actually occurred on the prospective piece of evidence and who may have been responsible for that occurrence.

-Comprehensive Reporting
One of the most important elements of the forensic analysis is often the written report. Technical information collected from the evidence and opinions about that evidence will have little value if they can not be presented in a technically accurate and understandable format.

A forensic report prepared by Loehrs & Associates includes detailed information about the matter at hand, the legal issues involved, what evidence was analyzed, why it was analyzed, how it was analyzed and comprehensive opinions about that analysis. Our forensic reports have resulted in favorable plea negotiations, settlements and dismissals on numerous cases saving the client time, expense and the potential negative outcomes of a trial.

-Expert Testimony
If a case goes to court, whether a hearing or a trial, expert testimony is often essential. Testifying experts are relied upon by the courts for technical facts about the electronic evidence as well as their opinions regarding what occurred, when it occurred, how it occurred and who may have been responsible the occurrence.

Tami Loehrs has been providing expert testimony for approximately ten years and has testified in both State and Federal courts throughout the country on more than fifty occasions in both civil and criminal mattters. Her education, experience and knowledge of computer forensics combined with her knowledge and experience in the legal industry has proven to be effective in court.

Biographies

Tami Loehrs, EnCe, ACE, CCFE, CHFI Click to reveal



Curriculum Vitae


TL@forensicsexpert.net

As President of Loehrs & Associates, Tami Loehrs, provides the company with more than 20 years of legal and computer experience. In 1999, Mrs. Loehrs founded Law2000, a successful computerized litigation support company offering the legal community with information technology support, computerized trial services, e-discovery and computer forensics services. Her work with the IT division gave Mrs. Loehrs hands-on experience in almost every aspect of computers including hardware, software, networking, remote access, security and Internet.

Mrs. Loehrs’ education includes a Bachelor of Science in Information Systems, hundreds of hours of ongoing computer forensics training, EnCase Certified Examiner (EnCE), Access Data Certified Examiner (ACE), Certified Computer Forensic Examiner (CCFE) and Certified Hacking Forensic Investigator (CHFI). In addition, Mrs. Loehrs holds a Private Investigator Agency License in the State of Arizona which requires a minimum of 6,000 hours of investigative experience.

Mrs. Loehrs has testified in State and Federal Courts throughout the United States and Puerto Rico over 50 times as a computer forensics expert. She has been a speaker for numerous organizations nationwide on the subjects of computer forensics and electronic discovery. As a result of her successful work in the field of computer forensics, Mrs. Loehrs has also appeared on television shows in the United States, Japan and New Zealand.


Robert Coelho, EnCE Click to reveal



Curriculum Vitae

RC@forensicsexpert.net

Robert “Bob” Coelho joined Loehrs & Associates in 2009 as a part-time Computer Forensics Analyst and brings with him more than 40 years of experience in the computer field. Bob has a masters degree in computer science from Johns Hopkins University and held a wide variety of positions of increasing responsibility, both technical and managerial, with a major chemical company prior to retiring in 2009. Bob has over sixty hours of specific computer forensics training and is a Certified EnCase Examiner. His continued interest in computer technology and in the work that Loehrs & Associates has been doing over the past several years brought him to us. Bob’s home is in the Baltimore, MD area which offers East Coast clients a local and more cost effective option.


Marlene Pulido (EnCE Pending) Click to reveal
MP@forensicsexpert.net

Marlene Pulido has been emplolyed with Loehrs & Associates since 2007 and has experience in every aspect of the company’s operation. She is a Licensed Private Investigator in the State of Arizona. Since 2009, Marlene has been conducting both off-stie and on-site forensics examinations including evidence acquisition, forensic analysis and report preparation. She is familiar with industry standard forensic methodologies, procedures and tools and has experience using forensic tools from Guidance Software, Access Data and Paraben, among numerous others. Marlene is currently preparing for her EnCase certification.

FAQs

-For what purpose would I need computer forensics? Click to reveal

Any time you believe information exists on a computer that may be needed in litigation, you should immediately enlist the services of a forensics expert.


-If the computer has already been examined by "the other side", do I need an independent exam? Click to reveal

Always have an independent forensics examination of any computer evidence that may be at issue. While the other side may have already examined the evidence, it is likely they examined it for their purposes, not yours. This is especially true in criminal cases inasmuch as law enforcement agencies rarely examine computer data for exculpatory evidence. Although evidence of wrongdoing may exist, it is every bit as important to answer the questions of who, how, when, where and why.


-Why can't my IT staff retrieve the data? Click to reveal

Although IT personnel may be very knowledgeable about hardware and software, a forensics expert is experienced in forensics methodologies and legalities needed for the evidence to hold up in court.


-What should I do if I think evidence exists on a computer? Click to reveal

If possible, discontinue any use of the computer, place in a secure location and contact Loehrs & Associates to obtain a forensics image as soon as possible.


Contact Us

Loehrs & Associates
3037 West Ina, Suite 121
Tucson, Arizona 85741

Phone: 520.219.6807
Fax: 520.622.7313
Email: info@forensicsexpert.net

Name


Organization


E-mail


Phone


Details




What Have We Done?

United States of America vs. Andrew Edward Flyer
No. 08-10580
C.C.No. 4:05-CR-01049-FRZ-GEE
Flyer Court of Appeals Opinion

After an undercover investigation by law enforcement using the LimeWire file sharing application, Flyer was indicted on four counts of knowingly transporting and possessing child pornography. Loehrs was hired to conduct an independent computer forensics examination of the evidence seized. During the forensic analysis, it was discovered that the evidence had been significantly accessed after it was seized and much of the child pornography that Flyer was charged with resided in unallocated space indicating the files had been deleted. At trial, Flyer was convicted on all counts by a jury. The case went to the Court of Appeals where they reversed the convictions on counts one, two and three.

Commonwealth of Massachusetts vs. Michael Fiola
0701CR4736
Tarnished Reputation: Boston Herald.Com

A Department of Industrial Accidents employee, Michael Fiola, was issued a DIA laptop computer equipped with wireless access. When the company noticed activity on the wireless bill greater than normal, the laptop was reviewed by the IT department where images of child pornography were found. Fiola was alleged to be responsible for the files, terminated from his employment and criminally charged. Loehrs was hired to conduct an independent computer forensics examination of Fiola’s laptop computer. The forensic analysis revealed the laptop was incorrectly setup by the DIA IT department prior to giving the computer to Fiola, leaving the computer unprotected for months. An infestation of viruses and Trojans that began prior to Fiola receiving the laptop computer were ultimately determined to be responsible for the pornographic activity. The State reviewed Loehrs’ report and could not refute the findings. The case was dismissed.

United States vs. Lori Drew
CR-08 582-GW-001
Judge Acquits Lori Drew in Cyberbullying Case, Overrules Jury

Lori Drew was alleged to have conspired with others to obtain a fictitious MySpace account for the purpose of cyberbullying a juvenile, Megan Meier, who committed suicide. Loehrs was hired by counsel for Drew to conduct a forensic examination of both the Drew and Meier computers. The forensic evidence revealed a very different story than that which was told by the government, much of which was never brought to light at the trial. A jury convicted Drew of lesser misdemeanor charges but the Judge overturned the jury’s ruling and acquitted Drew of all charges.

James A. Green vs. Lisa Frank, Inc.
No. 2 CA-CV 2008-0028
LFI v Green Court of Appeals Opinion

This case concerns the control and management of the LFI Corporation by James Green and Lisa Frank who both served on the Board. The trial court entered a stipulated order which temporarily enjoined Green from removing any intellectual property or other assets from LFI and to turn over a number of computers belonging to the corporation. Loehrs was hired by LFI to assist with forensically preserving and analyzing the electronic property turned over by Green. The forensic analysis revealed that Green violated the court’s Order by copying intellectual property secrets and destroying electronic data.

State of Arizona vs. Matthew Bandy
CR2005-014635
Technology Entraps the Innocent

After a cybertip from Yahoo! that contraband images had been uploaded to a Yahoo! Group, 16 year old Matt Bandy was arrested and charged with possession of child pornography. Although Bandy maintained his innocence and passed numerous lie detector and psychosexual tests, he faced approximately 90 years in prison. Loehrs was hired to examine the Bandy computer where her preliminary findings revealed approximately 200 viruses, Trojans and other malware that may have been responsible for the activity. Before any additional forensics analysis was conducted to determine the extent of the unwanted intrusions, the State offered Bandy a plea agreement with no jail time and no sex offender registration.

United States vs. Michael Keehn
07-CR 00532
Former TCCA Employee Facing Computer Fraud Charges

Michael Keehn was employed by the Tahoma Colusa Canal Authority (TCCA) for approximately 18 years during which time he designed and implemented a software application to regulate the canal. Keehn was fired from that position when the TCCA computer unexpectedly shut down one evening a computer technician for TCCA could not get the computer to boot. It was alleged that Keehn caused the shut down by remotely accessing the computer and wiping all of the data. Loehrs was hired to conduct a forensics examination of Keehn’s computers and the TCCA computer that was allegedly wiped by Keehn. The forensic analysis revealed a virus in the Master Boot Record of the TCCA computer that would not allow the computer to boot and a simple fix revealed all of the data was still intact. In addition, Keehn was alleged to have remotely accessed the computer using a dial up modem, the only means available to access the antiquated software, but no modem was seized from Keehn’s home and the forensic analysis revealed no modem was installed on any of the computers. The case was dismissed before going to trial.