Digital Forensics
Reconstruct activity. Understand the context.
Examine computer and storage records around the questions that matter in your dispute, investigation or incident.
01
Look beyond the visible document.
A computer examination can consider documents alongside relevant system and application records. The useful sources depend on the device, software, collection and activity in question. Define the question before choosing the artefacts to examine.
02
Build a chronology with context.
Compare available activity records, document history and relevant communications. A timestamp or event should be interpreted in the context of the system that created it, rather than treated as proof of a particular person’s action in isolation.
03
Explain the evidence and its limits.
Present the findings in a format suited to counsel or the organization. Distinguish what was observed from interpretation and identify questions that the available data cannot answer.
RELEVANT SOURCES
Start with what is available.
Discuss the sources that can help answer the question, within an authorized scope.
Windows and supported macOS systemsBEFORE WE BEGIN
A more useful first conversation.
- Identify the device and operating system if known.
- Describe the concerns and relevant dates.
- Discuss encryption and access without sending passwords through this website.
RELATED ARTICLES
Useful before you need us.
Practical perspectives and clear next steps.
YOUR NEXT STEP
What do you need to understand?
Tell us what you need to understand.