Computer Forensic Examinations

If you are a police force, defence solicitor or company that requires a computer forensic examination then E5h has the skills and expertise to assist.

What do we mean by computer forensics? It is the

The Preservation

Identification

Extraction

Interpretation

and documentation of computer evidence.

This must be done according to approved guidlines. The evidence obtained from computers or computer media is subject to the same rules of evidence as documentary evidence.

All our examinations are conducted according to the principles contained within the ACPO Good Practice Giude for Computer-Based Evidence.

Our investigators have training in the main forensic software packages such as Encase, AccessData Forensic Toolkit and X-Ways Forensics.

E5h Forensics can provide the following forensic services:

Data Preservation Service

Maybe you are unsure if you require a full forensic investigation or you deal with companies that have gone into liquidation and require the data from the computers to be preserved. We can create a forensic copy of the data for you ensuring that the data is available when needed.

Preview Service

If you are faced with potentally a large number of computers that need to be examined then the preview service might be the answer. By conducting keyword searches or examining key files on the computers it may be possible to reduce the numer of computers that require a full forensic examination and as a result reduce the overall cost of the investigation

Full Forensic Investigations

Our investigators can provide a full service from the preservation of the evidential data, through to the analysis and reporting. The investigators have experience in a wide range of criminal investigations, trojan defence cases and HR investigations.

 


 

 

  
 
 


Useful Information

The first time you are faced with an incident that may require a forensic response it is important that the right steps are taken.

It is tempting to ask the IT staff to have a look at the data on the computer to try and determine what has taken place and if a full forensic examination may be required. After all why call in a forensic company if it isn't really required.

The problem is the mere act of turning on the computer can change data that may be relevant to the investigation. Time and date information can be changed and in the worse case, vital data could be overwritten and lost.

As a result it may be impossible to bring the investigation to a successful conclusion.

If possible take the computer out of use and keep it in a secure location. You can then contact a forensic company for advice on the best way to proceed.

 

Useful Links


ACPO Good Practice Guide for Computer-Based Electronic Evidence

ACPO Good Practice and Advice Guide for Managers of e-Crime Investigations
E5h Forensic Solutions
1 Princess Drive, Sawston, Cambridgeshire, CB22 3DL 08709741131 email e5hinfo@e5hforensics.com