CCL-Forensics are happy for any clients or potential clients to visit their secure laboratory to see how their evidence is looked after. We have a dedicated Exhibits Officer who is responsible for evidence continuity and only the Exhibits Officer and the Forensics Manager have access to our secure evidence store.
For full details of our security procedures please
contact CCL-Forensics.
CCL-Forensics has vast experience in presenting evidence at a tribunal and the analysts understand the key differences in relation to appearing in court. Our reports are clear and concise and written so that all parties can understand them.
We are able to draw on the resources of our sister company
CCL-Management Services as well as strategic partners to provide a service to reduce or eliminate the requirements of digital forensics in the future.
The suite of software that our analysts use means that in most situations they can recover deleted text messages. It often depends on the handset as to whether the text message can be deleted and how many can be recovered. For further details
contact CCL-Forensics and look at our
mobile phone forensic page for more information.
CCL-Forensics 'image' a hard drive to produce a copy of the contents. This copy will then have a number associated to it (hash value), which is compared to the original hard drive's number. If these hash values are exactly the same then it is clear that the image is an exact copy of the original.
Unfortunately there is not a simple answer to this! CCL-Forensics provides a 'fixed price' quote which will vary depending on the media to be analysed, the number of items, the subject matter of the investigation, the requested turnaround time and whether the media is to be analysed on site, or back in the laboratory.
The fixed price will only vary if the media to be investigated turns out to be different to that described, but no extra cost is incurred before the client is advised and authorises any additional work.
Copying or moving a file from a computer to a thumb drive will often leave traces on the original computer. The more recently the activity occurred the more likely it is that the evidence is retained on the original computer.
To specifically overwrite a given file 3 or 4 times is a very technical procedure, beyond the reach of most users. In most cases we will be able to successfully recover data that has been deleted in the normal way but where advanced wiping utilities have been used the over-writing means that recovery may be beyond the means of current forensic technology. We can often tell if wiping software has been used, as many such applications leave traces on the suspects machine.
CCL-Forensics recognises the sensitive nature of certain cases and therefore are more than happy to enter into confidentiality agreements. Often clients like to complete this process before they discuss case specifics so that they have peace of mind. We can either use our own template confidentiality agreement or one provided to us by our client. If you would like a copy of our confidentiality agreement please
contact CCL-Forensics.
There are a number of accreditations that you should be aware of when choosing a forensic analyst. EnCase is the standard software that a forensic analyst must be proficient in, therefore it is essential that they have had training on this software.
References are difficult to offer due to the sensitive nature of this work however it is usually possible to be put in touch with some clients. CCL-Forensics can facilitate an introduction to satisfied clients, given a little notice.
To appear as a credible expert witness it is essential that the company is not only registered with a legal group, for example CCL-Forensics analysts are Sweet and Maxwell registered, but also that the company is independent.
Ask to see analysts' CVs if you are in any doubt as to their capability.
