Our Digital Forensics Lab
The identification and imaging of digital evidence can be key to successful litigation and dispute resolution.
With our newly built digital forensics lab at our Kent HQ, we have the internal capability to provide digital forensics services that can safely preserve and examine data found on digital devices and computer networks.
Our Certified Forensic Investigators, led by Richard Bell and Sean Nichol, are trained to recover and investigate material found in digital devices, including hard-drives, servers, laptops, smart-phones, networks and storage media by imaging these devices for further analysis and evidence review to support your case.
Recent cases where we have assisted clients, have included the:
- recovery of deleted company emails, documents and spreadsheets, sales proposals,
- identification of altered documents
- discovering internet browser histories and internet emails
- unauthorised access to company information
- downloading of malicious and pornographic content
- transfer of confidential files
- uploading of external devices
- recovery of other electronic generated documents
Imaging & Examination
Once the evidence has been seized and preserved, the forensic examination can begin, including the imaging (producing a working copy) of all digital data from the devices collected using specialised forensic software and hardware.
The imaging allows the original device to be preserved as an evidential exhibit, leaving the imaged version to be forensically tested and analysed.
Clients often request their devices to be imaged as a precaution and if required, to be analysed at a later stage in the investigation.
Working with our clients, the analysis phase of the digital forensic investigation is the interrogation of the data collected; this will include:
- testing investigation hypotheses
- traditional analysis of deleted files, browser history, access logs and file sharing
- understanding and interpreting the data structures
- examining storage components
- identifying clusters, meta-data and unallocated data sets
- keyword searches
- presenting evidential findings and statements
Preservation of Evidence
It is essential to follow forensic principles, evidence continuity and methodology when conducting a digital forensic investigation.
The initial phases of a typical digital forensic investigation are critical; we provide clients with a practical perspective and help them:
- Identify and seize items that may contain digital evidence
- Obtain the correct legal procedures and permissions
- Map and index electronically stored information (ESI)
- Help with decision making around loss of evidence
- Collect other available records
- Provide evidence handling and chain of custody
- Examine data from emerging technologies