Action to take if you feel your computer system or server may be compromised or the subject of illegal use - or that the user has perpetrated a fraud against you / used the machine for illegal reasons
Computer Forensics and Examination will obtain irrefutable evidence admissible in law. If you have suspicions, here is what to do first:
The internet, networks, laptops, portable devices (eg external drives / USB keys) and users accessing externally provide miscreants with the means to commit fraudulent, criminal or innapropriate activity or unauthorised usage in the workplace (e.g pornography or social networking sites). Computer Forensics have become an essential tool in providing evidence in cases of misuse or significant crimes such as embezzlement, theft of intellectual property etc
If in doubt - don't touch ! Never attempt to recover data or explore data from a computer without the necessary skills - this may affect the integrity of a chain of evidence to your later cost. When working with units our first move will be to clone the unit and conduct our work from the clone without booting the machine. By all means, however, take evidential photographs
Computer forensics is a generic name describing forensic analysis and reporting of computer or IT media. As well as the hard drive(s) this may include USB drives, MP3/4's, external drives etc. While most cases involve Windows Operating Systems we can also apply the same principles to Mac OS and Linux. Never make the error of believing that when you hit the delete key the information is gone - there is a high possibility deleted data may be recovered in it's entirety
We apply Computer forensics in investigation for many reasons including:
Forensic investigation in an employment tribunal case as reported in the Daily Telegraph
Computer Forensic analysis for companies with internal problems or lost information
Data recovery and timeline analysis on the instructions of Solicitors Nationally
Computer Investigation - Rebuilding files and building a timeline of events
Obtaining evidence - revealing the secrets a user has invested in a computer
Mobile Phone Forensics - applying forensic investigation to a miocile or cell phone
Preserving the Evidence - what steps to take before forensic investigation
Action on Scene - what to do, and what not to touch
