FAQ

Home > Services > Frequently Asked Questions

Can I determine if a duplicated hard drive is an exact copy of the original? »

CCL-Forensics 'image' a hard drive to produce a copy of the contents. This copy will then have a number associated to it (hash value), which is compared to the original hard drive's number. If these hash values are exactly the same then it is clear that the image is an exact copy of the original.

How much does a forensic examination cost? »

Unfortunately there is not a simple answer to this! CCL-Forensics provides a 'fixed price' quote which will vary depending on the media to be analysed, the number of items, the subject matter of the investigation, the requested turnaround time and whether the media is to be analysed on site, or back in the laboratory.

The fixed price will only vary if the media to be investigated turns out to be different to that described, but no extra cost is incurred before the client is advised and authorises any additional work.

Is there any evidence on the computer if a document has been downloaded onto say a thumb drive? »

Copying or moving a file from a computer to a thumb drive will often leave traces on the original computer. The more recently the activity occurred the more likely it is that the evidence is retained on the original computer.

Can you recover deleted information after it has been written over? »

To specifically overwrite a given file 3 or 4 times is a very technical procedure, beyond the reach of most users. In most cases we will be able to successfully recover data that has been deleted in the normal way but where advanced wiping utilities have been used the over-writing means that recovery may be beyond the means of current forensic technology. We can often tell if wiping software has been used, as many such applications leave traces on the suspects machine.

How can I guarantee nobody finds out about an investigation at my company? »

CCL-Forensics recognises the sensitive nature of certain cases and therefore are more than happy to enter into confidentiality agreements. Often clients like to complete this process before they discuss case specifics so that they have peace of mind. We can either use our own template confidentiality agreement or one provided to us by our client. If you would like a copy of our confidentiality agreement please contact CCL-Forensics.

How do I know that the analyst is suitably qualified? »

There are a number of accreditations that you should be aware of when choosing a forensic analyst. EnCase is the standard software that a forensic analyst must be proficient in, therefore it is essential that they have had training on this software.

References are difficult to offer due to the sensitive nature of this work however it is usually possible to be put in touch with some clients. CCL-Forensics can facilitate an introduction to satisfied clients, given a little notice.

To appear as a credible expert witness it is essential that the company is not only registered with a legal group, for example CCL-Forensics analysts are Sweet and Maxwell registered, but also that the company is independent.

Ask to see analysts' CVs if you are in any doubt as to their capability.