Trust Us
FAQ
+44 (0)845 125 4400
Working in a digital forensic lab
Communication
Tracing identities on the internet
What should I do if I need to examine a computer for potential evidence?
The device should not be used. If it is off do not power it up. Seal the device in a plastic bag and sign across the seal and lock it away in place where only selected people have access. The examination of the device should be completed by someone with suitable skills and experience. If I suspect something has taken place on a PC, can I have a quick look to ascertain whether the evidence is there first?
No. Do not touch the PC. Not only is it against the "Association of Chief Police Officer" (ACPO) guidelines, but you will also damage your chances of a successful outcome. If we have our own internal staff, can we use them to conduct the investigations?
Most of the time. To have your own competent and trained team makes you very fortunate, but in some internal cases using your own staff will mean that they are not impartial like an independent Forensic Analyst would be. Also, in some cases the data needing to be examined maybe company-sensitive to internal staff. If the computer seems broken, can you get any of my data back?
Yes we can. In most cases we can recover the majority, if not all of your data. To conduct the investigation, do you need all the computer equipment pertaining to the suspect user?
That depends on what you need us to look for. It is always a good idea to secure peripheral storage media, such as external hard disks, CDs, USB thumb drives as well as securing any back up tapes and server data that might be relevant. We will advise you how to do this and what will be needed. Do I have to bring the suspect computers to your labs?
No. We can either come to your offices and image the devices on-site, or we can use our point-to-point couriers to collect the equipment and bring it directly to our labs.
The device should not be used. If it is off do not power it up. Seal the device in a plastic bag and sign across the seal and lock it away in place where only selected people have access. The examination of the device should be completed by someone with suitable skills and experience. If I suspect something has taken place on a PC, can I have a quick look to ascertain whether the evidence is there first?
No. Do not touch the PC. Not only is it against the "Association of Chief Police Officer" (ACPO) guidelines, but you will also damage your chances of a successful outcome. If we have our own internal staff, can we use them to conduct the investigations?
Most of the time. To have your own competent and trained team makes you very fortunate, but in some internal cases using your own staff will mean that they are not impartial like an independent Forensic Analyst would be. Also, in some cases the data needing to be examined maybe company-sensitive to internal staff. If the computer seems broken, can you get any of my data back?
Yes we can. In most cases we can recover the majority, if not all of your data. To conduct the investigation, do you need all the computer equipment pertaining to the suspect user?
That depends on what you need us to look for. It is always a good idea to secure peripheral storage media, such as external hard disks, CDs, USB thumb drives as well as securing any back up tapes and server data that might be relevant. We will advise you how to do this and what will be needed. Do I have to bring the suspect computers to your labs?
No. We can either come to your offices and image the devices on-site, or we can use our point-to-point couriers to collect the equipment and bring it directly to our labs.
What if the evidence means we have to prosecute, can you advise and help us?
Yes, we provide expert witness services for the court and know the steps that must be taken and when.
Should we inform the Police?
This depends on what misdemeanour has occurred. Once you have told us the circumstances, we can advise you what is the best course of action and what your responsibilities are.
Are you always able to retrieve the evidence I need to find?
The key to finding the data you need often starts with the brief you give to us. The more detailed the brief, the more chances we have of finding some of the data you require. However, in some cases we will not be able to find all the evidence, perhaps just artefacts that point to the fact that this data did exist at some point in time, which maybe enough anyway.
Can you advise us how to resolve some of the problems we have relating to incidents and allied problems?
Yes we can, we are experienced in offering this type of consultancy and would be pleased to discuss your requirements with you.