Computer forensics

Computer forensic examination concerns specific devices, storage media and digital materials. Before starting, preserve their condition and establish which actions have already been performed since the event.

Subject of examination

• Computers, storage devices and available images
• Files, metadata and system logs
• Technical operating conditions and access information

Sample questions for the expert

• Which data and technical indicators are present on the object provided?
• Which actions or changes are supported by the available traces?
• Are there signs of the reported failure or information loss?
• How do the object's completeness, condition and history limit conclusions?

The final questions are formulated according to the objects and circumstances of the particular task.

What to prepare

• Description of the device, storage medium and event
• Available copies and details of their creation method
• Timeline of actions after the event
• Questions and accompanying technical documents

How the examination is conducted

The objects' contents and condition are recorded before examination. Where possible, work uses verifiable copies; significant actions and data used are documented. The method is selected for the specific question.

Scope and limitations

Starting, restoring or reinstalling the system yourself may alter traces. Availability of deleted data and the ability to identify a particular user are not guaranteed in advance.

What the deliverable records

Conclusions distinguish detected technical facts from hypotheses and identify circumstances that cannot be established from the object provided.