Fraud investigations involving digital evidence require advanced digital forensics skills to deal with the complexities and legal issues of extracting, preserving and analyzing electronic evidence. Our expertise ranges from computer and smartphone hardware to operating systems that run computers, network servers, and Internetwork devices such as routers, firewalls, and intrusion detection systems.
Evidence Acquisition
Forensically sound disk images are files containing the structure and contents of a disk storage device or a volume from sources such as solid state disks, optical disc or USB flash drive. A court admissible forensic physical disk image is a sector-by-sector copy of a medium where a digital fingerprint (aka “hash value”) was calculated during the acquisition process, and the imaging process did not alter the source medium. With the hash value in hand, copies of the images can be provided for litigation purposes and the integrity can be verified by rerunning the digital fingerprint and comparing hash values.
Evidence Analysis
This function involves the interpretation of the collected information in order to find artifacts supporting the case particulars. The analysis may be centered on file and application access times; identification of destroyed documents, and misappropriation of intellectual property such as document copying to USB devices, e-mail accounts or Cloud storage.
Documentation & Reporting
Defensible documentation demands disciplined event recording at the outset and generally begins with a chain of custody form. Documentation continues on throughout the life cycle of the engagement to log details regarding the evidence acquisition and analysis phases. Comprehensive case reports will encompass a scope, executive summary, chain of custody information, evidence acquisition details, detailed findings and supporting exhibits.
