CONTENTENGINEER® : ContentForensic™ Services support organisations, the legal profession and law enforcement agencies in the collection, examination and investigation of data held on electronic data storage systems including media and devices. Irrespective of the make, model and size of media, the Group use advanced software tool and specialised hardware to extract copies of data whilst preserving the evidential integrity of the source or original evidence. With experience of undertaking "LIVE" searches of volatile memory areas in security related matters, the Group supports inquiries with specific factual information and recovery of critical digital assets.

The demand for the Group's services in this highly specliased field, have resulted from the increasing capacity and processing capability of magnetic and silicon based storage devices appearing in everyday objects. Examination of systems, media and devices can be used in the broadest range of crimes including: digital fraud, inappropriate data duplications, financial/bankruptcy, disloyalty (employees), forgery, murder, theft, assault, copying of intellectual property, breach of contract, hacking, inappropriate internet, camera or sound usage, internet abuse and [illegal] email absue.

The increased complexity and density of electronic data storage will not cause the problem to disappear overnight. Even with encryption and password protection, no system is 100% safe as they have to be decrypted or accessed to actually be of use for normal, legitimate purposes!

- Protect valuable electronic evidence from contamination

- Accelerate investigations - identifying potential defendants and cause

- Extend reach of investigations - providing new triggers or support existing

- Actively enable support of victims - by identifying times, locations etc

- Avoid untimely release - by providing rapid response service

The Group has particular expertise in addressing the common issues of computer forensics, that can often "trip up" and investigation or where additional evidence may need to be sourced:

- Was access gained without the users consent?

- Was access gained remotely without the users knowledge?

- Was the hard disk drive contaminated in some way?

- Was the system switched-on inadvertently after seizure?

- Was data stored in a hidden area?

The Group also publishes a short Incident Response Guide that is available for download again from the resources section. BUT PLEASE NOTE, if there is any doubt as to the next steps in an investigation or management of an incident, do talk to an Expert as soon as possible. It is extremely easy to contaminated evidence on electronic data storage systems.