Global Forensic Imaging Service
- 22/01/2016
- Posted by: Alistair Ewing
- Categories: Computer Forensics, Investigative Techniques, Legal, Uncategorized
Compute Forensics LTD offer a global reach for our personalised forensic imaging process. We have agents and associates available at short notice to collect a plethora of data forensically. We cater to law firms, litigation support and even provide services for other digital forensic companies!
Why perform a forensic acquisition? Why not just copy the data?
Using IT staff or a layperson to copy data for a legal case or tribunal may jeopardise the integrity of the source data. Files are volatile, and any access or removal may result in data loss, a change in time stamp records or inadmissible evidence. Using a Compute Forensics LTD vetted Digital Forensic Expert ensures that the data can be copied in its entirety where possible including deleted areas and other partitions not picked up by copying. Along with that full chain of custody logs, exhibit tracking, digital fingerprints and collection reports can be produced to your companies or international standards. The end product will be working, and a backup copy of the target disk be it a Windows Machine, Apple Mac, Linux server or mobile phone (4000+ models supported) and documentation above. The deliverables can then be examined and exhibited. The exhibits and documents must appear robust enough to stand the scrutiny of the worlds most vigilant expert witnesses. The main advantage of examing a forensic image over the source disk is that exploring, even in a blocked state, may wear the source storage unit thus rendering any chance of precious data recovery and investigation impossible.
- Tools and techniques
Compute Forensics use a parallel forensic imaging approach, so the client only billed for the hour. The method the collection expert uses mean that specialist can copy as many drives at once as there are power sources. We image using tested forensic boot USB disks, and the fastest USB 3.0-3.1 write blocking equipment only. - Remote Imaging
On occasions, it may not be possible for an examiner to go the location of the data in person. In these circumstances, Compute can mail out a custom USB disk or CD and an encrypted destination USB 3.0 external drive. Compute can carefully guide the client through booting up the forensic write-blocked operating system. The user establishes a secure remote connection through the internet, and the expert can then go on to set the target disk copying to the now unencrypted destination drive. On completion the client can unplug the destination disk, sending it tracked to the processing lab preferred location. Should the destination data drive become lost in the postal system the client’s intellectual property is safe as the entire drive is locked using Veracrypt or similar needing a password to view the contents.
- What happens when you come across Faulty Disks?
We do not except filling in data with zeros on faulty sectors where evidence may reside or retrying defective drives further damaging the disk. Using advanced data recovery tools can copy the whole disc and retry bad areas until we get as close to a full 100% read as possible. - We have a server or system that cannot be powered down, can you still aid us?
Yes! By using special forensic software and techniques, our digital collection specialists can copy live files that are in use while preserving the Last Modified dates and other relevant metadata.
Once all the data has completed copying over and verifying, the files are then to be packaged inside a forensic container file. Unique digital fingerprints as MD5 or SHA1 hash sums are generated and certified identical to the original to ensure data integrity before signing the data out.
There is no need for server downtime!