FAQ’s

In recent years due to advances in computer software and hardware, the cost has decreased significantly. The prices can range from £72 an hour to £200 an hour. The process involves three steps: Acquisition, Analysis, and Reporting. Acquisitions cost around £500.00 for the day dependent. Analysis and reporting, of course, depend on the nature of your case. In most instances, searching and reporting can be completed in less than 15 hours, and the total analysis is usually less than £2000.00 GBP.

The forensic image or copying process can be done outside of business hours and even remotely when the user is using their workstation without their knowledge. In some cases, the image can be made remotely.

• Employee internet abuse
•Unauthorised disclosure of corporate information and data (accidental and intentional)
•Industrial espionage
•Damage assessment (following an incident)
•Criminal fraud and deception cases
•Protection, no contact or anti-harassment orders that either clearly express or that have incorporated by law that telephone, e-mail or other types of electronic communications are included.
•More general criminal cases where computers are alleged to be an instrumentality of crime and information is stored on computers that is evidence of crime(s) or potentially exculpatory evidence (many people store information on computers, intentionally or unwittingly).

Computer forensics is considered to be the use of analytical and investigative techniques to identify, collect, examine and preserve digital information in a manner that allows it to be used as evidence.

Firstly, if the device is switched on then leave it in that state. The system may have remote access so unplug the network cable and stop any WIFI connection if possible. If the computer is off, leave it off! If your staff haven’t been trained in Computer Forensics handling in evidence, then they have probably not produce contiguous chain-of-custody or followed other accepted evidence techniques. If proper evidence handling procedures have been used, the collection process itself has most likely altered, and tainted, the data collected. By opening, printing, saving files, the meta-data is irrevocably changed. The simple act of just turning on the computer changes caches, temporary files, and slack file space, which along with the alteration of the meta-data, may have severely damaged or destroyed any evidence that was present. Call us for advice!

We typically produce a couple of copies of the forensic image. Then we extract registry data, recover deleted files and index the disk for instant keyword search from the copy. 100’s of artefacts such as chat, web and other history are parsed from the unallocated areas of the disk. A supertimeline is produced for analysis to ascertain key events in the history.

Metadata is essentially data about data. For example, imagine you create a word document. The external Created (or born on date) is thus formed by how the system clock is set. The ‘Author’ field is updated to the owner of the computer input. If the document is typed into and ‘Saved’ this will update the ‘Last Saved’ and ‘Last Modified’ dates. The system as a whole has to be analysed to establish the integrity of a file as these fields can be manipulated by a user. A search of the system can yield evidence of clock tampering, deleted versions of the file and file usage via link file analysis.

Yes, but beware. Some firms use investigators without formal MAC forensic training and experience. In doing this, they may overlook MAC specific artefacts found in backups and other areas as they won’t be viewing the objects in their native format.

Compute Forensics will analyse anything that holds digital information. Volatile and non-volatile memory can be collected from any device that holds it.

Yes, our Sweet & Maxwell vetted expert witnesses work on private jobs, corporate investigations and legally aided work.