Computer and Laptop Forensic Examination

In many internal investigations and commercial disputes, the decisive trace sits on an employee's computer: copied files, deleted documents, connected USB drives or altered records.

Put together with the right method, these traces reveal the timeline of events. Switching the computer on and using it before an examination, on the other hand, can change timestamps.

• Write-protected forensic imaging and recording of the verification hash value
• File and folder structure with created, modified and accessed timestamps
• Analysis of deleted files and file slack
• User logon records and system event logs
• Identification of connected external devices (USB drives, external disks)
• Installed applications and application data
• Internet usage and browser artefacts
• Detection of encrypted volumes and hidden areas

The work begins by identifying the computer and drive relevant to the case. Analysis is carried out with forensic software, on the verified image only.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Forensic imaging and verification: a bit-for-bit forensic image is acquired through a hardware write blocker, and its hash value is calculated and recorded to verify that it matches the original.
3. Analysis: file system records, user sessions, USB history and application data are examined and combined into a single timeline.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Companies running internal investigations, parties to commercial disputes, law firms and individuals.