A computer forensic investigation is an analysis of all the information stored within a computer, (not just the documents), to determine what actions were performed, and by whom. Every document created and any activity that is conducted with a computer leaves a trail of evidence that can be followed and investigated by an expert in this discipline.

Many people now know that the word ‘delete’ in relation to a computer file, does not actually mean delete. More often than not, the data that was intentionally deleted still resides on the internal memory storage of the computer, (e.g. the hard disk drive). With the right skills and tools, these files can be recovered and provided for review at a later date.

What many people do not know is that most other actions that are performed with a computer can also be investigated. A modern operating system such as Microsoft Windows™ creates files and logs that allow an expert to determine who did what, when and how. A forensic expert can piece together such information to reveal a computer user’s conduct, sometimes even years after the events took place.

All our forensics work complies with Practice Direction 31 of the Civil Procedure Rules (CPR) for electronic evidence. During any computer forensic investigation, our experts take contemporaneous notes in order to support a later requirement for expert opinion, affidavits or oral testimony. It is rare in our experience for testimony to be required when the forensic investigation is conducted properly, because the facts obtained generally allow little room for varying opinion. However if required, our engineers can act under Part 35 of the Civil Procedure Rules (CPR) as an expert witness in Court.