KJB Computer Forensics Consultancy Ltd.

 

 

 

 

 

 

 

Acquisition of Digital Evidence

Best evidence is the physical device itself whether it is the computer hard drive, media card or any other form of digital storage device. It is for this reason that we try not to examine the computer hard drive/digital storage device itself, we create an exact copy - a forensic image of the device. Acquisition of Digital Evidence can be done onsite, during working hours or we can recover the device and image it in our office. We will work with you and provide whatever service is best for you.

It is the forensic image that is examined and where necessary produced as evidence to support a trial or tribunal.

It is important that when gathering computer based evidence,that it is done in a forensically sound manner. Where possible the following points should be noted when dealing with electronic evidence:

• No action should be taken that will change data held on a computer which may be subsequently used in a tribunal or other disciplinary hearing.
  
• Where it is deemed necessary to access original data held on a computer, that person must be competent to do so and be able to explain the relevance and the implications of their actions.
  
• An audit trail recording all actions/processes applied to computer based electronic evidence should be created and preserved.
  

These points should be adhered to; they protect the rights of the employee and employer. KJB Computer Forensics Consultancy experts are competent and very experienced in working within the aforementioned guidelines.

Please feel free to contact us if you require further information, we look forward to working with you in the not too distant future.