I examine computers, laptops, drives and USB storage in cases that require establishing what happened to data. The scope depends on the questions to be answered and the condition of the available material.
When an examination can help
- Suspected copying, deletion or unauthorised disclosure of files.
- A need to reconstruct user activity or a sequence of events.
- Disputes involving documents, correspondence or access to data.
- Examination of material following a security incident.
Scope of analysis
An examination may cover files and metadata, system artefacts, logs, browser history, available email data and traces of external device connections. Recovery of deleted data depends on the storage technology, encryption and whether the data has been overwritten.
How the work proceeds
- Define the questions to be answered and identify the available data sources.
- Agree on scope, timing, pricing and equipment handover.
- Preserve the material and prepare a copy for analysis where technically possible.
- Examine the data and document the actions performed.
- Deliver a report describing findings, methods and limitations.
What you receive
A technical report that connects findings to specific data sources. If the material cannot answer a question, that limitation is stated explicitly.
Before handing over the equipment
Do not install diagnostic tools, attempt data recovery or browse potentially relevant files before contacting me. The appropriate handling of a running or powered-off computer is determined individually.
If the material first needs to be preserved, see digital evidence preservation.