- Data Recovery Home
- Data Recovery Services
- Hard Drive Recovery
- External & USB Drives
- RAID / Server Recovery
- Mobile Phones & Tablets
- CCTV & DVR
- Windows Computers
- Lost & Deleted Files
- Advanced Forensic Data Recovery (ADR) Services
- Forensic Investigation
- Encrypted Volumes
- Tape Recovery
- Tape eDiscovery & Conversion
- Advanced Recovery Service
- Spare Parts & Donor Drives
- Disk Manufacturers
- SCSI Data Recovery
- SQL Recovery
- How Do Hard Drives Fail ?
- Help & Advice
- About Us / Contact
Forensic Data Investigation & eDiscovery
Forensic Computer Investigations – Computer Crime, Electronic Evidence & Expert Witness services
- Data Clinic provide forensic digital investigation (‘eDiscovery’) services into all types of computer and computer related crime
- Our computer forensics consultants are registered Expert Witnesses
- Our electronic evidence and forensic investigation procedures are ISO9000 certified
- We act for both prosecution and defence
- We offer countrywide investigations plus onsite and offsite services
Click to find out more about our forensic data recovery services
Whether the system is a standalone computer, mobile phone, portable device or part of an integrated network, Data Clinic’s experienced eDiscovery technicians can assist you from the initial evidence gathering or fact finding, through to the successful outcome – be it external prosecution, Industrial Tribunal or internal disciplinary action.
- Advice on initiation of an investigation where forensic data recovery and eDiscovery is required
- Advice on the seizing and securing of that evidence
- Acquire data on site (overtly or covertly) or at the Data Clinic forensic laboratory
- Recover data that you thought had long gone
- Examine the recovered data according to the instructions you give us
- Provide easy to read technical reports outlining our findings
- Provide expert testimony if required
All our work is carried out following current Best Practice, ACPO guidelines, contemporaneous notes and records are kept to prove the chain of custody.
Our clients are guaranteed confidentiality and all case-related communications are strictly confidential.
We are able to undertake both on and off-site investigations and as a general rule will use the following stages in our project implementations.
The science of computing and the laws of evidence are both complex, we therefore insist that prior to any specific computer forensic investigation being initiated that a protocol for our engagement is established, and that this protocol is fully understood and capable of being implemented by all the parties involved in the planned investigation. To achieve this we will consult with a client to:
- Establish the specific roles that individuals and organisations will play in the investigation.
- Identify where matters of evidence are likely to be located.
- Undertake a mandatory intelligence review in order to establish what types of hardware, software, systems and back-up material might relate to the potential evidence being sought.
- Communicate a plan for the collection and analysis of data, the processing, documentation and reporting of information,
- Produce a written estimate of timescales and costs involved.
- Present a formal contract describing our terms of engagement, matters of confidentiality etc.
System Audit and Data Collection
Following our initial consultation and given your authority to proceed, we will inspect and freeze computer systems and associated components making it impossible for subsequent changes to be made to their content or configuration. Data collection is then undertaken with applications who”s use is de-facto in forensic investigations involving information stored on computers.
In matters of evidence it is mandatory that a strict “chain-of-custody” is followed and all items are preserved for independent or further safe analysis.
The Data Clinic uses specific applications to recover and image the suspect media. Using the Image produced our forensic experts can then investigate the computer system and files for evidence.
Our computer forensic analysts are always operating under the primary instruction and guidance of you the client or your legal counsel in any particular matter. Data Clinic experts are able to advise, interpret and piece together information for you in a comprehensive manner and detail a thorough account of events, computer usage and content. Using forensic image files our expert analysts investigate the media and its content including altered, damaged, removed, hidden or deleted data or data from inactive or unused storage areas on the media. They then provide an historical ledger of the relevant content contained in the files
Expert Testimony and Reporting
Once the investigation is complete we will support your case by preparing and submitting reports about the evidence found, and the means by which it was discovered. We will also provide data for affidavits or other pleadings, expert testimony and reports.
The Data Clinic terminates its involvement by submitting the total data collected in a readable format either electronic, print for archive or to an existing litigation support database upon request. We will then consult on the storage and preservation of evidence in the event of appeal or review etc.
Mobile Phone Forensics
Mobile phone forensics is a subset of digital forensics relating to recovery of digital evidence or data from a mobile device under forensically sound conditions. The phrase mobile device usually refers to mobile phones; however, it can also relate to any digital device that has both internal memory and communication ability, including PDA devices, GPS devices and tablet computers.
The use of phones in crime has been widely recognised for several years, but the forensic study of mobile devices is relatively new, dating from the early 2000s. Data Clinic have been involved in the recovery of data from mobile devices since 2002 and you can find out more regarding our mobile phone forensics recovery services here.
- Summary of the ACPO Guidelines regarding computer based electronic evidence, plus a link to the full document on the UK government site
- Summary of the law on the possession, manufacture and distribution of illegal images of children, plus a link to the full document on the UK government site
- More about our CCTV image recovery and enhancement services
- More about our eDiscovery services on tapes and legacy media
- More information about our forensic data recovery services