Forensic Computer Crime Investigation

London and Manchester, UK
0870 7424 008

Forensic Computer Investigations
The work of the Data Clinic's Computer Crime Investigation Unit

To find out more about our forensic services call 0870 7424 008 and ask to speak to the Computer Investigation Unit
nb. all enquiries are treated as confidential

Recent instructions given to the Data Clinic include cases involving:

• Fraud
• Computer Misuse in the workplace
• Child Pornography
• Theft involving intellectual property
• Forensic accounting

Data Clinic Ltd provide independent forensic analysis and expert witness in matters involving prosecution and defence. We are instructed by the legal profession, UK police forces, Standards Board for England, Department of Works and Pensions etc.

Testimonials

"...satisfactory outcome all round as we appear to have protected our proprietary information."

"...An excellent result. Your forensic evidence highlighted several errors and omissions in the Prosecutions forensic evidence, forcing them to retract their forensic evidence and causing their case to collapse"

The Data Clinic is unable to directly disclose details of matters we have investigated, however in cases of public interest press reports describe our involvement, as with this extract from The Guardian: Child porn download Councillor banned

We are frequently asked to write articles regarding data forensic examination and investigation, the latest is titled "Electronic Forensics in an International Environment" and is written by Darren Michael, Data Clinic's Senior Forensic Examiner. You can read his article in the Spring 2004 edition of the Barrister magazine by clicking the link above.

Services

We are able to undertake both on and off-site investigations and as a general rule will use the following stages in our project implementations.

Consultation

The science of computing and the laws of evidence are both complex, we therefore insist that prior to any specific computer forensic investigation being initiated that a protocol for our engagement is established, and that this protocol is fully understood and capable of being implemented by all the parties involved in the planned investigation. To achieve this we will consult with a client to:
- Establish the specific roles that individuals and organisations will play in the investigation.
- Identify where matters of evidence are likely to be located.
- Undertake a mandatory intelligence review in order to establish what types of hardware, software, systems and back-up material might relate to the potential evidence being sought.
- Communicate a plan for the collection and analysis of data, the processing, documentation and reporting of information,
- Produce a written estimate of timescales and costs involved.
- Present a formal contract describing our terms of engagement, matters of confidentiality etc.

System Audit and Data Collection

Following our initial consultation and given your authority to proceed, we will inspect and freeze computer systems and associated components making it impossible for subsequent changes to be made to their content or configuration. Data collection is then undertaken with applications who's use is de-facto in forensic investigations involving information stored on computers.

Securing Evidence

In matters of evidence it is mandatory that a strict "chain-of-custody" is followed and all items are preserved for independent or further safe analysis.

Recovery

The Data Clinic uses specific applications to recover and image the suspect media. Using the Image produced our forensic experts can then investigate the computer system and files for evidence.

Forensic Analysis

Our computer forensic analysts are always operating under the primary instruction and guidance of you the client or your legal counsel in any particular matter. Data Clinic experts are able to advise, interpret and piece together information for you in a comprehensive manner and detail a thorough account of events, computer usage and content. Using foremsic image files our expert analysts investigate the media and its content including altered, damaged, removed, hidden or deleted data or data from inactive or unused storage areas on the media. They then provide an historical ledger of the relevant content contained in the files.

Expert Testimony and Reporting

Once the investigation is complete we will support your case by preparing and submitting reports about the evidence found, and the means by which it was discovered. We will also provide data for affidavits or other pleadings, expert testimony and reports.

Termination

The Data Clinic terminates its involvement by submitting the total data collected in a readable format either electronic, print for archive or to an existing litigation support database upon request. We will then consult on the storage and preservation of evidence in the event of appeal or review etc.

For further information please call us on 0870 7424 008

(c) 2004 Data Clinic Ltd