Piecing digital evidence together to support solicitors, businesses and public organisations in computer forensic investigations.

Industry recognised experts, Computer Forensic Specialists are repeated engaged as computer forensic analysts for both criminal and civil claims. With a wealth of knowledge and experience backed up by accreditation and highly qualified engineers, we are best placed to discuss your digital forensics, e-discovery, cyber crime or expert witness requirements.

Data Forensics is most often associated with the investigation of a wide variety of computer, mobile phone and internet crime. However, computer evidence may also be used in civil proceedings. The discipline involves similar techniques and principles to data recovery, but with additional guidelines and practices designed to create a legal audit trail as dictated by the Civil Procedure Rules and ACPO Guidelines for Electronic Evidence.

Computer Forensic Specialists have become a vital asset in providing evidence in cases such as computer misuse and attacks against computer systems. We are also used to trace lines of communication in traditional claims. This includes the forensic analysis and reporting of all digital media, regardless of the physical condition of the media, format or operating system. Computer Forensics can help Internal Audit, IT Service Desk, HR, Legal Services and Information Security. However, we also provide computer forensic analysis for smaller organisations and even home users, to determine what actions were performed by who and when.

Our enviable reputation stems from our highly tenacious and painstakingly meticulous approach to data analysis, our willingness to scour devices for every fragment of evidence and our ability to communicate complex technical information clearly and concisely – whether via written reports or expert witness testimony. Our work is performed at a fixed hourly rate or per gigabyte of information and the client will always be given a no-obligation capped quote, before any work is undertaken. To avoid needless investigation, we will complete a free assessment to determine the "value" of the evidence supplied in relation to our client's claim.

► Data Acquisition.
Data acquisition or imaging to create an exact sector level duplicate (or "forensic duplicate") of the media using a write blocking device. The imaging of the media and investigation of the evidence is performed whilst strictly following the ACPO guidelines and taking care to maintain the integrity of the evidence.
After acquisition the contents of the image files are analysed to identify evidence that either supports or contradicts a hypothesis or for signs of tampering (to hide data). During an investigation, the original evidence is stored securely, preventing the possibility of compromise. Details on the image such as hashes, size, format, imaging time etc are included in any report.
Expert Opinion.
When an investigation is completed the information is reported in a form suitable for non-technical individuals for discussion in legal proceedings. Reports also include audit information and other meta-documentation