Identifying and gathering digital evidence is key to successful litigation and dispute resolution.
Digital Forensics is an investigation discipline that often provides evidence to support an internal fraud investigation or cyber-attack. Our Certified Forensic Practitioners are trained to recover and investigate material found in digital devices, including hard-drives, servers, laptops, smart-phones, networks and storage media by imaging these devices for further analysis and evidence review.
Our Practitioners identify evidence including the recovery of deleted company emails, encrypted files, documents and spreadsheets, sales proposals, altered documents, internet browser histories, internet emails, hacking, transfer of files, uploading of external devices and the recovery of other electronic generated documents.
Our advice is to act quickly by contacting TenIntelligence as soon as possible. Don’t try and recover or search for documents yourself, as your activity will alter the date and time stamps embedded in electronic documents and transactions, which could render the evidence as inadmissible. The preservation and integrity of evidence is paramount.
Preservation of Evidence
It is essential to follow forensic principles, evidence continuity and methodology when conducting a digital forensic investigation. Our Certified Practitioners have a working understanding of the legalities, best practice and methodologies used in the current digital forensic environment. We apply evidential continuity, covering seizure, exhibit handling, data collection and preservation through to examination and investigation.
The initial phases of a typical digital forensic investigation are critical; we provide clients with a practical perspective and help them:
- Identify and seize items that may contain digital evidence
- Obtain the correct legal procedures and permissions
- Map and index electronically stored information (ESI)
- Help with decision making around loss of evidence
- Collecting other available records
- Evidence handling and chain of custody
- Examination of data from emerging technologies
Imaging & Examination
Once the evidence has been seized and preserved, the forensic examination can begin, including the imaging (producing a working copy) of all digital data from the devices collected using specialised forensic software and hardware.
The imaging allows the original device to be preserved as an evidential exhibit, leaving the imaged version to be forensically tested and analysed.
Clients often request their devices to be imaged as a precaution and if required, to be analysed at a later stage in the investigation.
Working with our clients, the analysis phase of the digital forensic investigation is the interrogation of the data collected; this will include:
- testing investigation hypotheses
- traditional analysis of deleted files, browser history, access logs and file sharing
- understanding and interpreting the data structures
- examining storage components
- identifying clusters, meta-data and unallocated data sets
- keyword searches
- presenting evidential findings and statements