Computer forensics, put simply, is the process of analysing the data stored in a computer in an auditable and repeatable manner so that the evidence it produces can be used in a criminal or civil court, or at a tribunal or other legal / disciplinary hearing.This includes any previously deleted data which can be recovered using forensic tools and techniques.

It is important that computer forensics is only carried out by qualified personnel, as any other approach could open up the investigation to legal challenge.

If computer misuse is suspected in the workplace, it is vital that you follow a few simple procedures to ensure that the evidence is not changed or compromised in any way. The keyboard, mouse or any other buttons or switches should not be touched. Please refer to our guidelines in cases of suspected computer misuse document.

Once the computer has been secured (CCL-Forensics can provide staff on site to do this if required) it is returned to our forensic laboratory in Warwickshire, where a forensic copy is made of the hard drive.

This process “known as imaging”, creates a bit-for-bit copy of the data, which can then be analysed. The analysis focuses in on the exact requirements of the case, and the evidence gained can be used to demonstrate whether certain activity did – or didn’t necessarily – take place on that machine.

The application of computer forensics is different, depending on the sector it is used in. Please choose your sector from the list below:

• Law enforcement
• Legal services: criminal defence / civil proceedings
• Corporate sector
• Public sector