FORENSICS

As usage of computers in the workplace increases, so too does the potential for a data incident. The best mitigation strategy for such risk is the creation of an Incident Response Plan, providing a procedure for dealing with such issues as: -

Computer misuse

Data theft

Data sabotage

Data disclosure

Intellectual Property theft

One key part of the incident response strategy is to identify and select an independent data forensics service that can mobilise quickly to assist your organisation in the authoritative and qualified identification of the facts involved.

 

BEST TECHNOLOGY > BEST PRACTICE

CDS uses the latest in available techniques, technology, and software to ensure that an investigation can be brought to the best possible technical conclusion. Using the same software, hardware and training that is used by law enforcement agencies worldwide, our forensic solutions will help resolve even the most complex situations involving retrieval, reconstruction and analysis of data from any computer hardware, operating system or application.

 

UNDERSTANDING > DELIVERING

When approaching a project, our dedicated project manager will seek to obtain a comprehensive view of the circumstances surrounding each incident. At that stage, a specification for the project can be readily established and agreed. While the requirements of each project will vary, most cases usually share some common areas of discovery, such as: -

Deleted files

Hidden files

Evidence of data copying to a removable media

Internet activity

Email activity

 

INDEPENDENCE > INTEGRITY

Should an incident arise, the least preferred approach should be to request an internal member of staff to investigate computer hard drive data content. Aside from possible impartiality issues, the investigation may not be conducted in a forensically-correct manner unless the staff member has specific training and equipment at their disposal. Should the investigation methodology be called into question at a later time, it would be reasonable to assume that incorrectly gathered evidence would be deemed inadmissible.

 

UNIVERSAL PROCESSES > CONFIDENTIALITY

The primary imaging process is conducted on-site and is used to generate a certifiable and exact copy of the hard drive contents without affecting the integrity of the original drive contents in any way. CDS employ ENCASE, which is a universally accepted and courtroom-recognised forensic image acquisition system. For purposes of security and confidentiality, subsequent investigative work is performed away from the customer's premises using the forensic drive image, leaving the original drive available for use/secure storage at the client's site. It is essential that imaging be conducted at the earliest possible opportunity following an incident in order to prevent possible overwriting of important data on the computer's hard drive

 

For a free and confidential consultation, call 1890 237100.