“The amount of information you guys provided was just plain scary”
The type of service you are likely to need is unique to your situation - there is no “one size fits all” approach that works with a digital forensic investigation. That said, there are a number of components, or modules, which can be employed. The individual services shown below can be mixed and matched to suit your requirement.
If you're not sure whether a forensic examination is appropriate, why not have a quick read through some of our recent cases to see where an examination was relevant, what we examined, and why. If you're still unsure, then by all means give us a call, we're happy to have a free confidential discussion about your situation so you'll have a clear understanding of the limitations and benefits of undertaking this work.
Without committing to the process of copying the data, Preview & Triage allows the subjects data to be viewed with the chance of making any changes to it - using tools and processes that protect it's integrity. We can search for particular artefacts of interest and often give you a quick heads-up as to whether you're likely to find the things you're interested in.
When multiple devices are involved, it's a quick and easy way of prioritising them and perhaps eliminating a number of them right from the start - this can help keep examination timings and costs to a minimum when budgets are tight.
We have a page which discusses this process in a bit more detail; read more.
Imaging is simply copying - although it's carried out following a very strict protocol to ensure that not so much as one bit of one byte changes as a result of the process. It also copies not just the data, but all of the deleted space too.
The reason that imaging is important is that it's where the whole forensic process begins. If it is tainted or not carried out correctly, then everything that follows is similarly tainted and may be set aside by judicial authorities if things get serious down the line.
Imaging is a simple process which is cheap and doesn't commit you to anything further - in that regard it can be a great insurance policy as the digital crime scene has been frozen, giving you options later if required; read more.
Our Fast-Trak service is aimed at clients who have a limited timescale and the resources in-house to review material themselves. Typically it focuses on extracting all email, documents and photographs onto a set of disks so that the in-house team can go through them and locate the material of interest.
Once this material is discovered, we jump back in and provide the forensic provenance for each of the artefacts of interest, describing its name, location, size, creator and the various dates associated with files; read more.
Like the Fast-Trak analysis above, a Focused Analysis is a targeted investigation looking for specific things but relies on the analyst to locate and identify artefacts of interest. This is where in-house resources may not be available or the client may require the impartiality that a third party investigator offers.
The benefit afforded by this approach means that actions and data falling outside the parameters of the investigation, for example; between two specific dates, are ignored and the analysis can proceed more quickly to locate the data that's relevant to this specific case. It's fair to say that most cases contain an element of this focus, but the level or degree of it is what sets this type of investigation apart; read more.
When you need to be sure that nothing is missed, or if the parameters of the investigation are very wide, in terms of people involved, the time line of events or the type of actions suspected, then a Full Analysis will provide the most effective means to reach a satisfactory conclusion. It is based on the same foundations as other investigation types, but provides a full, court-ready, forensic technical report to assist your case through whatever legal process is appropriate.
This is our most commonly employed service and in cases where the terms of reference are not well known, it provides the most cost effective way to progress a digital forensic investigation; read more.
After the analysis is complete and the report is written, you may find you are required to interview the subject of an inquiry, or at least discuss the case with them. It can be very intimidating to be sat across from a technically competent computer user who may have used encryption and other means to cover their tracks. We can sit with you during this interview process to ensure that you're not being mislead or that the subject is not misunderstanding the evidence present in the report.
We are happy to take a flexible role in this process and be as active as you feel is appropriate, from simply listening and taking notes for discussion later, through to asking questions and leading the interview; read more.
At the end of the investigative process is the provision of Expert Witness testimony. This may be for an internal HR hearing, an industrial tribunal or even at court for criminal or civil matters. Our scientists are expert witness trained and have extensive experience giving oral evidence in these formal legal settings; read more.
We can have a forensic analyst on-site, anywhere in the UK within 12 hours of the initial call.
We have the expertise, experience and tools to help you navigate an investigation and emerge on the other side with a clear understanding of what happened and why.
Either telephone us at the number above, or send us a note by email and we'll respond straight away.