Internet and User Activity Forensic Examination

What a user was doing at a given moment is rarely answered by one record; the answer lies in combining several traces.

Even if browser history has been cleared, the cache, system records and application data can still be assessed. Analysis should therefore never rely on a single source.

• Browser history, bookmarks and cache records
• Detection of downloads and uploads
• Logon/logoff and user account activity
• Application usage artefacts
• Network connection records and accessed resources
• Search for deleted browser data
• Building a forensic timeline
• Structured reporting of findings

We collect traces from different sources, such as browser databases, system logs, the Windows registry and application data, and merge them on a single time axis. This combined timeline gives a picture that individual records cannot.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Forensic imaging and verification: a bit-for-bit forensic image is acquired through a hardware write blocker, and its hash value is calculated and recorded to verify that it matches the original.
3. Analysis: traces from different sources are correlated by time, with separate checks for time zone and system clock differences.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Organisations running internal investigations, employment law matters and parties to commercial disputes.