Recovering, analysing and presenting digital evidence stored in computers
Computer Forensics involves the analysis of Electronically Stored Information (ESI) via a methodical approach that adheres strictly to ACPO Guidelines and best practices. With over 2 billion personal computers being used worldwide, data stored on desktops, laptops and hard drives are now an integral component in establishing factual information within civil and criminal cases.
A computer forensic investigator is not an IT technician. Years of training and ongoing development is standard, as deciphering binary and metadata on a computer can be as complex and precise as understanding human DNA. To have a computer involved in a case should be viewed as an absolute asset, as the quantity, variety, and potential value of data stored on the hard drive can be invaluable. However, if best practice guidelines are not followed, and forensic experts are not deployed, evidence can be lost forever and it becomes inadmissible in court or at tribunals.
The CYFOR investigations team use the latest computer forensics examination techniques to provide a profile of usage to ensure the highest quality of investigations and reporting is adhered to.
Digital evidence that we are regularly instructed to recover and analyse includes;
- Email correspondence including deleted emails
- Social media communication, including Skype, Facebook and Twitter
- Internet activity
- Stolen electronic data / intellectual property
- Password cracking
- Deleted files & folders
- Creation times and dates
- Analysis of usage
CYFOR employ the latest rigorous digital forensic techniques to search, identify and categorise the relevant evidential data within an investigation. We invest heavily in our advanced technology platforms, which includes specialist software such as AccessData, Cellebrite, Nuix and Relativity.
Recovery of Deleted Data
Deleted doesn’t mean unrecoverable and CYFOR’s computer forensic specialists have extensive expertise, spanning a broad range of investigations. They will produce a full technical report detailing all of the forensic analysis findings, placing your enquiry in the safest and most experienced hands.
Onsite Data Collection
CYFOR have the full forensic capability for onsite data collection and are called upon frequently to execute covert data collections. So whether an exhibit is deemed too important to exit the premises, or an employee’s device(s) need ‘imaging’, we can assist immediately.
Imaging of Devices
‘Imaging’ is an exact forensic replica of digital media stored on a devices hard drive. This preserves the data for court proceedings or investigations that occur at a later date and allows the original device to remain intact. This is especially useful in covert operations.
Remote Data Download
By using the advanced features of the Nuix software platform, CYFOR can securely and forensically collect data via the internet. This also allows us to download and retrieve virtually anything from a system using remote desktop collection, including the following accounts;
- Mail stores
- Google Drive
- Microsoft OneDrive
- Apple iCloud
This is important if you have international clients or must collect data at short notice, as it does not require any form of mobilisation from a forensic investigator or any type of onsite investigation.
Analysis of retrieved data
The search, recovery and analysis of data stored on computer devices can be crucial within civil and criminal matters. This can include data that has apparently been deleted from a device such as a computer, laptop or hard drive but in actual fact is still present.
We utilise the latest forensic software such as EnCase to provide complete and thorough Computer Forensic Analysis and are proud to have leading industry experts at our disposal, including ex-military forensic investigators. The analysis we provide includes a full break down of the relevant findings, which can be presented in court by our Expert Witness trained specialists.