Computer forensics is used when a case requires facts to be established concerning computers, electronic storage media, files, networks, programs or digital data.
For court proceedings, specific answers usually matter more than general discussion: which data exist, when they were created or changed, and whether there are signs of deletion, correction, access, failure or a technical malfunction.
Before an examination is ordered, it is useful to formulate questions and establish whether the materials are sufficient. Sometimes conclusions require original files, storage media, logs or system access in addition to screenshots.
What to do before contacting us
- preserve original files and documents;
- avoid unnecessary changes to storage media and data;
- prepare a list of questions;
- state whether the examination is required for court proceedings or before litigation.
What the court specifies
The court specifies the examination subject, questions, materials and expert institution or individual expert. The parties may propose questions and provide information about a suitably qualified specialist.
Objects provided for examination
- computers, laptops, servers and storage devices;
- software and digital files;
- databases, logs and backups;
- websites, applications and cloud environments;
- contracts, technical specifications, acceptance certificates and correspondence.
Data preservation
Before examination, changes to the object should preferably be prevented: do not reinstall the system, delete files or continue actively using a storage medium if this could overwrite relevant data.
Preliminary preparation
Before an examination is ordered, advice may be obtained on the materials required and question wording, without substituting for the future court-appointed examination.
How work with a specialist proceeds
First, the task and available materials undergo a preliminary review. The examination subject, technically appropriate questions, required access and deliverable format are then agreed. If the initial data are insufficient, the specialist identifies in advance which additional files, documents or exports must be preserved.
The final opinion distinguishes the information provided, actions performed, indicators established, limitations and conclusions. This structure makes the reasoning verifiable and enables the document to be used in a formal claim, negotiations or court proceedings.
When to seek advice in advance
The earlier original data are preserved, the lower the risk of loss or alteration. Before reinstalling a system, updating software, clearing logs or handing a device over for repair, it is advisable to discuss how the materials should be recorded.