Computer Forensic Investigations

Computer forensics otherwise known as digital forensics or cyber forensics, involves acquiring, examining, analyzing and presentation of digital evidence stored in computers, external hard drives, memory sticks and network storage devices in the form of documents, images, emails, user profiles and log files.

E2Labs investigators can help law enforcement agencies, criminal prosecutors, military intelligence officers, insurance companies, surveillance officers, compliance officials, information security departments, lawyers, solicitors, auditors, courts, tribunals and private investigators in their search for valuable digital evidence hidden in various data storage devices.

Involving identifying, acquiring, capturing data sources, gathering digital evidence, analysing facts and trends and presenting the findings in format admissible in any litigation or reliable in a civil or criminal investigation.
Involving recovering data from laptop or desktop computers, external or internal hard drives, USB pen drives, memory sticks, mobile phones and digital voice recorders. Lost data may have occurred "naturally" as a result of hard disk or media failure or deliberate deletion attempt or sabotage by the suspect under investigation. Recovery of lost data is an invaluable asset to data forensic investigators in establishing key facts in their search for potential crucial evidentiary material from a variety of computer media data sources.
Involving detailed and comprehensive specific data search items such as emails, images, documents, spreadsheets, logs, chat conversations etc in all digital data sources such as hard drives, memory sticks, media players, mobile phones and network or remote drives.
Involving full and irrecoverable secure wipe of sensitive data from computers, hard drives, memory sticks and any digital storages device which may hold such data. This could be a single computer or hard drive or server RAID array or a network storage device. Secure data erasure is required when computers or hard drive containing sensitive information has to be recycled or transferred to a different organisation or department or change of ownership or business cessation occurs.
It has to be noted that some of the most valuable information obtained in the course of a forensic examination will come from the computer user himself. An interview with the user- if he is cooperative- can yield valuable clues about the system configuration, applications, encryption keys and methodology. Computer forensic analysis is much easier when analysts have the user's passwords to access encrypted files, containers, and network servers. However if the user refuses to cooperate or the computer user interview is not possible, the digital forensic investigator will be fully equipped with necessary tools to uncover most- if not all- of the information he requires in order to carry out his computer forensic investigation successfully. However, in any investigation in which the owner of the digital evidence has not given consent to have his or her media examined (as in some criminal cases), we take special care to ensure that the computer forensic specialist has the legal authority to seize, copy, and examine the data. All the legal clearances required for a successful computer forensic investigation must be sought by the client prior to the investigation. This will be discussed with the client in the initial stages of a computer forensic service inquiry or assessment.