Evidence work in Hull · for solicitors, HR and insurers
In Hull, as in every place, there is usually significant harm done within the first hour of a problem occurring through someone's best intentions. In an effort to assist, someone examines a computer and opens some files whose dates are then updated in a way which can't be undone. Therefore, all images are created using a hardware write block prior to opening any files; continuity logs are documented at the examination table as they occur rather than a week later; and reports are designed knowing that another expert will attempt to pick at them. Additionally, examinations are always independent, stay quiet about who initiated the request, and clearly show when the data stops providing useful information.
Ring us, in confidence
0800 6890668
| What you see | What the material shows | What we hand over |
|---|---|---|
| The laptop in question | The laptop has been blocked, imaged and then viewed on the copy for artefacts, documents and the chronological sequence in which events occurred. | Answer written in plain English. |
| Individuals who have left and taken their files with them. | Any USB devices that were connected to the laptop, any uploads to webmail or cloud storage, any deletions and/or wipes that were completed along with dates associated with all activities. | Documentation that both HR and your solicitor can use. |
| Deleted files which are now needed for a case. | Evidence of deleted files including when they existed, when they were removed and what subsequent activity transpired, obtained with continuity maintained. | The recovered files, their date, and how they were obtained |
| An encrypted volume and the right to access it | Passware proceeds once you've demonstrated your entitlement and a key is accessible | What was inside and how the lock was opened |
| A case being referred to a hearing | The same benchwork is then documented as relevant to whatever rules apply (CPR Part 35 or CrimPR Part 19) | A report in the format required by the applicable rules. |
| Video stuck on a CCTV camera recorder. | With continuity preserved, the video images are extracted from the hard drive using the process described in the CCTV documentation pages. | The playable video footage plus the documentation to support it. |
This commences with a confidential discussion, and there is no cost involved. These three elements will define the remainder of our work together: What happened? How extensive is this issue (machines, accounts etc.)? And what does the data/evidence need to prove? Together these three factors establish the scope. The scope defines the fixed fee. You have this fixed fee in writing prior to any equipment being examined.
Nothing is examined or viewed prior to applying the blocker. The blocker is applied, and then the image is captured. After the image has been captured, then and only then does anyone examine it. The device is considered part of the evidence in and of itself and therefore the only thing that is looked at is the copy. Once all of the images are complete, the originals go into storage.
All subsequent processes occur on the image. One tool that can be used to analyse the image is OSForensics. This tool can be used to identify various types of artefacts that exist on the system including what was opened at what time, what was deleted, and in what order these events occurred. All notes are created during the process as opposed to creating them based upon memory once the process is completed.
The answer to your question is found at the beginning of the report in simple terms followed by any technical details that may be available for those that want to review them. Findings that could potentially benefit neither party remain in the report and stay there.
Reports that cannot be tested will be worth little. Therefore, the bundle includes all of the work: exhibits, images, logs of handovers, hashes of everything and notes taken at the time. A third party (the opposing side's expert) can simply repeat our process and reach the same point we reached.
Why secure evidence early, and why secure evidence yourself: once a workstation remains operational during an incident, it is no longer the same workstation two weeks later. Windows continuously updates the system, previously deleted data becomes available for reuse, and logs continue to roll over. Evidence captured on day one will represent what actually existed at that time; however, evidence captured a month into the ongoing operation of the workstation may represent completely different information. If an incident appears to potentially create a future dispute, have an image of the workstation taken while the data still exists on the drive and store the original equipment.
| The gear | What we use it for | Why we have it |
|---|---|---|
| X-Ways Forensics | Detailed analysis of disk images: artefacts, usage history, deleted files and timelines. | Fast. Clutter free. Better to have a small bench know one tool well. |
| OSForensics | Creates an index of every file on a whole Windows machine or an exact duplicate of such a machine, thus allowing searches of all files. | The first wide pass through everything: registry hives, recent-file lists, every USB device ever plugged in. |
| Passware | Encrypted volumes where opening them is lawful, and where a key can be got at. | Either it opens or it does not open. Regardless, the report documents which happened and no results are "massaged" into existence. |
| Atola Insight Forensic | Acquisition behind a write block: hashing occurs during the same pass. | The system logs the acquisition process itself, therefore continuity begins at the first sector. |
| ACE Lab PC-3000 & Data Extractor | Firmware-level repair, for when the evidence is also a failing drive. | A single drive can represent both the evidence and the repaired unit (both trades are conducted in this room). |
Why mention it: a forensic examiner is required by the Criminal Procedure Rules to inform others if there is anything that may detract from their ability to present credible testimony. In this case the lack of accreditation represents exactly that. Mentioning it first is not modesty; it removes what would likely be the easiest thing an opposing party would ask about.
Thievery was what the client believed we would find. What really occurred was less exciting: an incorrectly configured sync client automatically cleared the contents of a shared folder. There were enough remaining pieces to successfully restore most of it. Ultimately, this finding resolved the matter without having to accuse anyone.
Three steps are involved in digital forensic analysis. Firstly the material is copied; secondly the copy is examined; thirdly any information found during this process is documented in a way that will survive being picked apart. Nothing is read before there is a copy. Notes for an examination are taken at the work bench while the work is being conducted, with enough detail that another examiner can follow the same track and arrive at the same result.
Each instruction will look like something else, therefore there is no way to read the cost off a list. Scoping out the job costs nothing. After scoping, one written figure (imaging, examination and report) must be agreed prior to touching the device. Prices start at £800 + VAT. No one works from a meter here.
No. We have a bench area that can handle hard drives and other storage media, PCs, Macs, and CCTV and DVR recorders. Handsets are not part of this bench area. If we find that the case actually rests with the handset, we will inform you about it during the initial call and direct you to an appropriate lab that specialises in handling handsets.
No. We do not possess any UKAS accreditation or ISO certificates. This is stated on page one of every report because we are required to disclose it. In its place is our methodology which anybody can review: a hardware write block is placed upon the acquisition of the items; MD5 and SHA-256 are calculated and verified; each step of the process is documented as it occurs; and a final report is generated consistent with CPR 35 or CrimPR 19 depending upon whether the proceedings are civil or criminal.
The clip you wish to obtain is currently being recorded over; the deadline has not changed. Log a job. The initial review will cost you nothing; your comments remain confidential.