Computer Forensics

CONTENTENGINEER : ContentForensic Services support organisations, the legal profession and law enforcement agencies in the collection, examination and investigation of data held on electronic data storage systems including media and devices. Irrespective of the make, model and size of media, the Group use advanced software tools and specialised hardware to extract copies of data whilst preserving the evidential integrity of the source or original evidence. With experience of undertaking "LIVE" searches of volatile memory areas in security related matters, the Group supports inquiries with specific factual information and recovery of critical digital assets.

The demand for the Group's services in this highly specliased field, have resulted from the increasing capacity and processing capability of magnetic and silicon based storage devices appearing in everyday objects. Examination of systems, media and devices can be used in the broadest range of crimes including: digital fraud, inappropriate data duplications, financial/bankruptcy, disloyalty (employees), forgery, murder, theft, assault, copying of intellectual property, breach of contract, hacking, inappropriate internet, camera or sound usage, internet abuse and [illegal] email abuse.

The increased complexity and density of electronic data storage will not cause the problem to disappear overnight. Even with encryption and password protection, no system is 100% safe as they have to be decrypted or accessed to actually be of use for normal, legitimate purposes!

Service Benefits

The process, procedures and technologies adopted by the Group enable Clients to:

• Protect valuable electronic evidence from contamination
• Accelerate investigations - identifying potential defendants and cause
• Extend reach of investigations - providing new triggers or support existing
• Actively enable support of victims - by identifying times, locations etc
• Avoid untimely release - by providing rapid response service

Engagements

Each engagement in the field of forensics is unique. Different case, different evidence all create different challenges for the Group. Whether it be a criminal or civil matter that requires technical expertise, the same principles apply. All forensic engagements are covered by either a formal engagement letter or special order form that outlines the search/recovery paradigms, timeframes, case history and other special instructions that will enable the Expert to provide information as quickly as practically and safe to do so.

Back to top

The Group has particular expertise in addressing the common issues of computer forensics, that can often "trip up" an investigation or where additional evidence may need to be sourced:

• Was access gained without the users consent?
• Was access gained remotely without the users knowledge?
• Was the hard disk drive contaminated in some way?
• Was the system switched-on inadvertently after seizure?
• Was data stored in a hidden area?

System, Media and Devices

The Group undertakes work on the majority of electronic data storage systems, media and devices including associated evidence. This includes devices embedded in a variety of systems (server, desktop, laptop, PDA, mobile, TIVO, CCTV recorder etc). Details of these and other information storage elements can be found in the GRID within the resources section. The Group also publishes a short Incident Response Guide that is available for download again from the resources section. BUT PLEASE NOTE, if there is any doubt as to the next steps in an investigation or management of an incident, do talk to an Expert as soon as possible. It is extremely easy to contaminate evidence on electronic data storage systems.

Related Services

The Group also undertakes Data Recovery Services for prevention and recovery of data from systems; and associated Expert Witness Services. The engagement of an Expert at the early stage of an investigation can enable rapid identification of critical data artefacts that can assist with the matter. For more information about CONTENTENGINEER : ContentForensic Services do not hesitate to contact us.

Back to top