Computer Forensics
Corporate sector menu
Follow the links below to find more information on forensics in the corporate sector...
Corporate case studies
Read about CCL-Forensics' work on corporate cases...
Testimonial
Thank you for your prompt recovery and report, it was just the detail I was looking for. Can I send you another sim for the same treatment?
Computer Forensics
Practically every member of office-based staff has access to one - or nowadays, possibly several – computers. Not only this, but they have access to external hard drives, memory sticks, printers and other peripherals.
The scope for them to misuse these devices is increasing. It can range from wasting company time by excessive personal use, to accessing inappropriate websites which compromise your technology, to theft of sensitive company data.
When this happens – or is suspected – it is important that you act correctly, as digital data is fragile and a single misplaced act can make crucial changes to the data. Please see our guidelines on how to respond in the first instance. Then call CCL-Forensics immediately. We can help by providing:
Forensic imaging/data capture
This process is vital in preserving the integrity of the data. A computer which is suspected to have been involved in any type of misuse should not be used, and advice should be sought immediately.
Please call 01789 261200 for advice on how to proceed.
The process of imaging a computer involves making a forensic copy of the hard drive, using a write-blocking device which ensures no changes are made to the original. It also means that any subsequent investigation takes place on the forensic copy and not the original device.
On-site and covert services
When it is necessary for forensic imaging to be carried out on site, our trained analysts can attend your premises (covertly if required) to secure the potential evidence. This is usually conducted under the supervision of the HR or IT department, and ensures that those under suspicion are not made aware of the investigation. Once imaged, the data is returned to our laboratories for analysis. Initial analysis can also be carried out on site, where required.
Once the forensic image has been created, it can be analysed at our dedicated laboratory by a team of experienced forensic analysts.
They can investigate down to the finest digital detail, how a computer has been used (or misused) including which files have been created, accessed or copied – along with investigating web and email history and details of which devices have been plugged into the computer and what they were used for.
Computer forensic analysis
This process is highly technical and follows a defined scope, agreed with the client in advance, to ensure a targeted and cost-effective solution.
CCL-Forensics' team of analysts will carry out a thorough investigation of the data contained in the forensic image to analyse how the computer has been used, and extract any relevant evidence which may be present. This includes deleted data which may be present on the hard drive, which is not accessible to a typical user, but can still be recovered by digital forensic analysis.
Delivery times are agreed in advance, and all work is carried out on a fixed-scope, fixed-price basis.
The outcome of the investigation is presented to the client in plain English and in whatever format is agreed upfront.
Deleted data recovery
Any activity carried out on a computer, even if it has been deleted, still has the potential to be recovered during forensic analysis.
When a user clicks "delete", the computer simply removes the reference to the file in its file allocation table. The data can remain on the hard drive for a considerable amount of time - dependent on how much the PC or laptop is used during that time.
This deleted data could provide additional crucial evidence to substantiate your investigation.
Corporate training courses
CCL-Forensics runs a training course several times a year on how to respond when suspicions of computer misuse are first raised. It details how to handle the evidence, and what needs to be done in the initial stages to prevent a later legal challenge.
For more information about the responding to computer misuse course contact CCL-Forensics on 01789 261200.
Other IT consultancy services
CCL-Forensics' sister company CCL (Computer Consultants Limited) offers a range of IT consultancy services focusing on ERP and CRM - including IT project management, specification and selection and IT strategy.
For more information please visit their website at www.cclnet.co.uk or call 01789 403000.
Can I do computer forensics myself?
The initial response to any such incident is crucial. The computer needs to be handled correctly to prevent data from being compromised. Most companies do not have an internal digital forensic capability, as it wouldn’t be cost effective to do so. In these cases, it is vital that a trained digital forensic expert is consulted immediately. CCL-Forensics provides a round-the-clock service – call 01789 261200 for more details.
Internal IT departments, while extremely knowledgeable, are not normally trained in digital forensic techniques, and companies do not have the relevant accreditation (including ISO17025) to carry out a digital forensic examination.
Please contact CCL-Forensics for more details on 01789 261200. Alternatively, take a look at the details of our course on how to respond in the initial stages of an enquiry.
