What is Computer Forensics?

What is computer forensics? CYFOR’s Head of Investigations details this specialist digital forensics technique, which can provide vital digital evidence within criminal and civil investigations.

What is Computer Forensics?

What is Computer Forensics? It is a specialist process that involves the analysis of Electronically Stored Information (ESI) that is stored on electronic devices, such as desktop computers, laptops and external hard drives. This digital forensic analysis is executed via a methodical approach to verify factual information within civil or criminal matters. The process is reliant on strict adherence to the Forensic Science Regulator Code of Practice so that the integrity of the digital evidence is admissible in court.

The Forensic Science Regulator Code of Practice

The Forensic Science Regulator Act 2021 sets out the Regulator’s statutory powers along with the Regulator’s duty to prepare and publish a code of practice about the carrying on of forensic science activities in England and Wales.

The United Kingdom Accreditation Service (UKAS) issues accreditation to Forensic Science Activities. Compliance with the FSR Code and the FSR Act is a mark of reliability for the criminal justice system. Showing an organisation’s dedication to ensuring justice and quality standards.

CYFOR is extremely proud to have achieved not only accreditation to the Code but also accreditation to ISO 17025, reaffirming our dedication to compliance, excellence and providing a quality service that can be relied upon in court.

Some of the main FSR principles are as follows:

• Ensuring methods are fully validated allows forensic practitioners to rely upon the methodology and forensic tool used.
• Being able to define, demonstrate, and test the initial and ongoing competence of personnel
• Developing, reviewing and updating internal documented and controlled procedures
• Establishing and implementing a rigorous internal audit process that ensures, methodology is applied, procedures are followed and staff remain effective and compliant
• Unwavering commitment from senior leadership to quality and the code
• Enabling and embracing continuous improvement

Computer Forensics Expert

A computer forensic investigator is not an IT technician. Years of training and ongoing development are standard, as deciphering binary and metadata on a computer can be as complex and precise as understanding human DNA. To have a computer involved in an investigation should be viewed as an absolute asset. As the quantity, variety, and potential value of data stored on the hard drive can be invaluable. However, if best practice guidelines are not followed, and forensic experts are not deployed, evidence can be lost. It can also become inadmissible in court or at tribunals.

Forensic ‘Imaging’ of devices

Forensic ‘Imaging’ is an exact forensic replica of digital media stored on the hard drive of an electronic device, such as a computer. The process is also the first stage of a computer forensic investigation. This preserves the data as an exhibit for further investigations and court proceedings, allowing the original evidence on the hard drive to be protected and remain intact. This is especially useful in covert operations, where information is required without the knowledge of the investigated party(s).

What evidence can be retrieved?

• Email correspondence, including deleted emails
• Internet activity, history, account information and downloads
• Stolen electronic data / intellectual property
• Deleted files, folders, images and videos
• Operating data, including creation times, dates and system logs

The application of Computer Forensics

Computer forensics can cover a vast range of cases within commercial, civil and criminal investigations, such as;

• Intellectual property theft
• Indecent imagery investigations
• Employment disputes
• Fraud investigations
• Bankruptcy investigations
• Regulatory compliance
• Litigation & dispute resolution