Computer Forensic Analysis, Data Forensics and Data Recovery

Forensically gained digital evidence plays a critical part in both criminal and civil investigations that involve electronic evidence. In the U.K. alone, computer misuse by employees costs businesses an estimated £3billion pounds a year. The Association of Chief Police Officers (ACPO) Guidelines for computer based evidence gathering give clear and specific procedural directions for how electronic evidence must be obtained.

Using certified computer forensic specialists, WIA provides unrivalled support in the field of Data Recovery and Data Forensic Analysis. Our dedicated forensic examiners provide independent expert specialist services to corporate enterprises, human resource departments, internal investigation and security departments, solicitors, private investigators, and private individuals throughout the U.K.

Using the latest in powerful forensic diagnostics tools and data recovery techniques, lost and even deleted hard drive and data file content can be retrieved, restored and where necessary, fully analysed and presented for evidential purposes.

With rapidly advancing computer technology, hard drives are increasingly capable of storing huge amounts of information. Cyber crime, employee computer misuse or executive misconduct, intellectual property theft, copyright infringement, employee disputes and even infidelity and cheating partner investigations all benefit from the recovery of erased or so called ‘deleted’ information and files. In most cases, it is entirely possible for data forensic experts to recover, analyse and present evidence, which our clients had otherwise thought to be lost. The same can be said of PDA’s, mobile phones, laptops (PC’s or Apple Mac’s), back up storage devices, or portable storage devices.

Data Forensic Examinations in CRIMINAL CASES include:

• Computer Misuse
• Employment Tribunals
• E-Crime
• Hacking
• Digital Sabotage
• Fraud and Theft
• Illegal Pornography

Data Forensic Examination use in CIVIL CASES includes:

• Divorce Proceedings
• Family Law
• Computer Misuse
• Social Media
• Pornography
• Electronic Conversations

What is recoverable?

Just because data has been deleted does not mean that it is unrecoverable. Using a variety of cutting edge techniques and equipment, much of which is not readily available to the general public, forensic experts can search for and retrieve:

• Deleted user name activity
• Deleted data files and documents
• Partially over written files
• Deleted emails
• Deleted chat room content
• Deleted photos/video/audio/graphics files
• Website browsing history
• Use of social networking sites (Facebook, Yahoo, Dating Sites, MSN etc)
• Uninstalled software
• Address books and contact files
• SMS/Text messages

What devices can we analyse?

• Personal Computers (PC and .MAC)
• Laptops
• Networks
• Redundant Array of Independent Disks
• Network Attached Storage
• Mobile Phones
• Portable Devices

How do we do it?

ACPO Guidelines for Electronic Evidence/ Forensic Data Recovery are followed as standard to ensure the integrity and continuity of evidence is maintained throughout the investigation. Typically, an investigation would include:

• Case preparation
• Preservation of the evidence - an exact image ‘clone’ of the hard drive is taken
• Examination of the cloned drive is performed
• Analysis of all data discovered using a full range of forensic software tools
• Manual checking and review of the analysed data is performed
• A full report is compiled and presented in an easy to follow format

The Data Forensic Team

Our Data Forensics Team are all trained to Degree standard in Computer Forensics, are registered Expert Witnesses (for court purposes) and hold the following qualifications:

• BSC Hons, Computer forensics
• ACE Access Data certified
• Chartered Engineers

Where necessary, the Forensic Team can provide evidence of expert opinion, affidavits or oral testimony and act under Part 35 of the Civil Procedure Rules as an expert witness in Court.

Forensic Services Available

Criminal Investigations

ACPO Recognised Full Forensic Examination which includes imaging of the hard drive and preserving the media in a forensic manner using ACPO recognised evidence file formats approved by courts worldwide. A full analysis, book marking and reporting, using a comprehensive range of specialised utilities. Our experts take contemporaneous notes in order to support a later requirement for expert witness, affidavits or oral testimony.

Civil claims and Possible Criminal Investigations

Forensic Examination, which includes imaging the drive and preserving the media in a professional forensic manner. Full analysis of keywords, book marking and reporting. This can be escalated if the findings are such that a criminal claim may be pursued at a later date.

Civil Investigations and Enquiries

Digital Examination which includes imaging the drive and preserving the media, analysing the information and determining what actions were performed, when and by whom, followed by basic reporting, to satisfy the client or in cases of a civil claim, to provide evidence in support of that civil claim.

To understand more in relation to Data Forensics and Data Recovery, contact us today on 01789 770980.