Forensic Computer Investigation Computer Fraud

Forensic examination of computers from an investigative approach

Being able to handle Computer Investigation in-house stands us apart from other private investigators - we don't subcontract the work, enabling the fruits of an investigation to be relevantly applied to other aspects.

Follow the ' See next page - Computer Investigation ' button below for information about what can be achieved, and the immediate action you should take to preserve evidence

Many users think that deleting a computer file, or clearing browsing history will remove the data (and evidence) from their computer - a mistake many have found to their cost. A computer is a mathematical algorithm, and what has been removed can be returned when the machine is investigated; contents of files, with times and dates of when files were created and web sites visited, email and instant message transcripts, images, videos - anything that machine may have been used for since it was built

While our methods will adapt from instance to instance, the basics are likely to be:

Making a copy (clone) of the hard drive for us to work on, leaving the original evidentially intact

Having made a second back-up copy, rebuilding any deleted or obscured files

Extracting any hidden files, and password protected files

Building a web cache to show, in a readable format, web sites visited and when

Rebuilding email and instant messaging transcripts

Creating a timeline of events

Sorting files by type as well as date and size, providing an easy manipulated viewer

String searches of phrases and file names

Computer forensics, put simply, is applying an investigative analysis of a machine's hard drive and external peripherals to obtain legal evidence. Such evidence may be used in a corporate world , when an employee is stealing trade secrets or passing information to a third party, or perhaps in insatnces of internet misuse and fraud.

Retaining the integrity of what may be evidence may be very important - we have suggestions here as to what to initially do

Make sure that nothing is compromised by your initial actions

Make sure nothing is damaged; it is best not to touch if other methodology - such as fingerprinting (including keyboards etc) - may be employed

A chain of custody shows the movements of the computer and that no-one else has had the opportunity to amend it

We keep the disruption to your business or personal environment to a minimum

News item in the Daily Telegraph regarding investigation of a computer used in a teacher's class who failed to prevent young pupils accessing pornographic images

We are Corporate Investigators with experience spanning several decades, using such as computer analysis and other forensic tools as an aid to investigation of business affairs

Investigation of a computer can be an evidential aid in litigation, particularly in emplyment matters where the actions of an employee can be determined from investigation of their company laptop