Forensic Computer Investigations
- Computer Crime, Electronic Evidence & Expert Witness services
- Data Clinic provide digital investigation services into
all types of computer and computer related crime
- Our computer forensics consultants are registered Expert
Witness
- Our electronic evidence and forensic investigation procedures
are ISO9000 certified
- We act for both prosecution and defence
Whether the system is a standalone computer, portable
device or part of an integrated network, Data Clinic’s experienced
technicians can assist you from the initial evidence gathering or fact
finding, through to the successful outcome - be it external prosecution,
Industrial Tribunal or internal disciplinary action.
Data Clinic provide the following assistance for the investigation
of digital data:
- Advice on initiation of an investigation where data recovery is
required
- Advice on the seizing and securing of that evidence
- Acquire data on site (overtly or covertly) or at the Data Clinic
forensic laboratory
- Recover data that you thought had long gone
- Examine the recovered data according to the instructions you give
us
- Provide easy to read technical reports outlining our findings
- Provide expert testimony if required
All our work is carried out following current Best Practice, contemporaneous
notes and records are kept to prove the chain of custody.
Our clients are guaranteed confidentiality and all case-related communications
are strictly confidential.
Investigative Services
We are able to undertake both on and off-site investigations and as
a general rule will use the following stages in our project implementations.
Consultation
The science of computing and the laws of evidence are both complex,
we therefore insist that prior to any specific computer forensic investigation
being initiated that a protocol for our engagement is established, and
that this protocol is fully understood and capable of being implemented
by all the parties involved in the planned investigation. To achieve
this we will consult with a client to:
- Establish the specific roles that individuals and organisations
will play in the investigation.
- Identify where matters of evidence are likely to be located.
- Undertake a mandatory intelligence review in order to establish
what types of hardware, software, systems and back-up material might
relate to the potential evidence being sought.
- Communicate a plan for the collection and analysis of data, the
processing, documentation and reporting of information,
- Produce a written estimate of timescales and costs involved.
- Present a formal contract describing our terms of engagement, matters
of confidentiality etc.
System Audit and Data Collection
Following our initial consultation and given your authority to proceed,
we will inspect and freeze computer systems and associated components
making it impossible for subsequent changes to be made to their content
or configuration. Data collection is then undertaken with applications
who's use is de-facto in forensic investigations involving information
stored on computers.
Securing Evidence
In matters of evidence it is mandatory that a strict "chain-of-custody"
is followed and all items are preserved for independent or further safe
analysis.
Recovery
The Data Clinic uses specific applications to recover and image the
suspect media. Using the Image produced our forensic experts can then
investigate the computer system and files for evidence.
Forensic Analysis
Our computer forensic analysts are always operating under the primary
instruction and guidance of you the client or your legal counsel in
any particular matter. Data Clinic experts are able to advise, interpret
and piece together information for you in a comprehensive manner and
detail a thorough account of events, computer usage and content. Using
forensic image files our expert analysts investigate the media and its
content including altered, damaged, removed, hidden or deleted data
or data from inactive or unused storage areas on the media. They then
provide an historical ledger of the relevant content contained in the
files.
Expert Testimony and Reporting
Once the investigation is complete we will support your case by preparing
and submitting reports about the evidence found, and the means by which
it was discovered. We will also provide data for affidavits or other
pleadings, expert testimony and reports.
Termination
The Data Clinic terminates its involvement by submitting the total
data collected in a readable format either electronic, print for archive
or to an existing litigation support database upon request. We will
then consult on the storage and preservation of evidence in the event
of appeal or review etc.
Further reading...
> Data Clinic
Case Studies - Read about some of the computer
misuse cases the Data Clinic have been involved
in
> Illegal photographs on storage
media (eg. hard disk) - Brief guidelines regarding the law
and indecent
photographs / images such as child pornography
> Recovering
footage from CCTV equipment
> ACPO Guidelines - These are
guidelines published by the Association of Chief Police Officers regarding
Good Practice
for Computer based electronic evidence
> General guidelines on the correct
seizure
of computer media for investigative purposes
> Frequently Asked Questions regarding
computer
evidence acquisition and investigation
> Engaging
the services of the Data Clinic for computer investigation
> "Data
Forensics in an International Environment" -
Data Clinic article published in "The Barrister" magazine
> Data hiding
experiment: We used our detailed knowledge of hard drive design
& data recovery techniques in a simple experiment that enabled us
to successfully conceal data on a hard disk. This concealment
defeated all the forensic recovery tools (including EnCase and XWays)
that were used to find it. Read our data
hiding experiment (PDF), and contact us for further
details regarding recovering hidden data that uses this technique.
> Data
Clinic's EMAK hardware
The Data Clinic offer computer investigation
for both prosecution and defence.
For further information please call us on 0870
140 2525
|
