Forensic computing and
litigation support
Forensic computing can be defined as the formalised methodology for collecting, analysing and presenting computer based information making it suitable for presentation in a court of law. Traditionally associated with the law enforcement agencies this high-tech area of science is being more widely used in a range of civil litigation.
Today the technology available to modern business is increasing at an unprecedented rate. Moore’s law of processor power doubling every eighteen months can equally be applied to data storage and peripheral technology. Any prediction of future technology we make now will be out of date by the time you read this. Processor power is perhaps less significant to the investigator than it is to the user but it does change the scenario of typical use and enlarges the scale of operations that any one computer might be used for. When the fax machine starts up we never know what we may be asked to work with.
Digital Techniques has provided independent expert services for over 10 years and during that time the world of forensic computing has evolved from very humble beginnings to a refined science and discipline with the majority of the formalisation occurring in the last three years.
Digital Techniques are able to assist with comprehensive testing and
reporting on-
Analysis of hardware and software to determine conformance to specification and/or correct operation.
Opinion on the suitability of computer solutions in relation to normal business practice and industry standards.
Where appropriate the securing of data in a way that the original data remains unaltered and evidentially intact.
Retrieval of deleted and protected material where possible and the analysis of apparently unused portions of a disk system.
Analysis of data recovered from such investigations comment or integrity of date stamps, creation modification and last used information.
Management of the computer forensic aspects of an investigation.
One of the big scares of the last 24 months has been y2k compatibility and the press have had a field day predicting waves of litigation in response to failures. We have seen cases for non fulfillment of contract but nowhere near the volume the scare mongers predicted. What we are seeing are late comers setting increasingly tight and difficult timescales for vendors who, in the natural course of events, may be tempted to accept sales and yet be hard pushed to deliver.
Digital Techniques' experts are experienced in the analysis of computer systems and the production of reports acceptable to the Court. The traditional system of each side in a civil case appointing their own expert is changing (with the Woolf reforms) and the role of the jointly appointed expert is one in which a true balance and independence must be maintained. We will not undertake a commission if fees or payment are in any way dependant upon results. Our aim is to provide you, and the Court should you wish, with a simple understandable view of the technicalities in a case and provide our opinion on areas where the facts cannot lead an observer to an obvious conclusion. Our opinions are based on real experience of the computer industry over the last twenty years and are backed by a constant watch on current technology.
A key element of modern computing is storage. All investigations, disputes and litigation will involve data held on servers, desktop computers, laptops, handheld computers or personal organisers. Securing an analysis of this data poses problems that are not encountered with hard copy. Even switching on a computer can alter files held on the hard disk and make them evidentially unreliable. The vast quantities of data residing on even the most modest of modern computers can make analysis a cumbersome and difficult process. Consequently valuable material may be missed unless the process is approached correctly.
Storage capacities are increasing at a dramatic rate and the technologies used for storage can creates an issue for the investigator bring into question some of the imaging techniques used by data recovery companies.
CD-ROMS, for instance, are no longer considered massive in their ability to store data when compared to hard drives. Optical drives are better but care must be taken with evidential integrity. The tried and trusted methods of partisan copies and good forensic practice are still the best solution.
There are a number of credible forensic computing companies in the UK (and a selection of backstreet operations that you may wish to avoid) however these organisations principally specialise in computer imaging (copying) systems and operate almost exclusively in the criminal law arena. Whilst a great deal of the technology is directly transferable to civil litigation but there are differences. For instance a large number of criminal proceedings will result in the seizure of computer equipment and complete access to it for forensic purposes. In this respect the police have a wide range of powers not available to the Claimant in a civil litigation.
Even during the execution of an enter, search and seize order for example the civil litigant may not enjoy freedom to image a complete computer. Whilst an independent technical consultant may be present only information covered directly by the order may be copied or taken away. Data not covered by the order may not be copied. Doubtful information may only be placed in the hands of the supervising solicitor. This leads to some almost impossible demands on the attendant expert with regard to the maintenance of forensic evidence. If the opposing side do not agree to a complete image being taken it would not be legal to do so. Under these and similar circumstances an expert must maintain forensic integrity without compromising the owner's security or the reliability of evidence extracted from the search. This difficult, but not impossible task does not lend itself to mechanical methods.
The human approach has advantages in flexibility as well. We make no assumptions of what we will find. We will try to reveal all aspects of a system under scrutiny and not just those of the defence or prosecution. A number of the current forensic computing companies have been, in our experience, focused on working with the police and law enforcement agencies which inevitably limits their view of the overall situation. Focused on prosecution. Consider for example the case of an individual accused of storing pornographic material on their computer. It would be easy enough for a forensic scientist working on behalf of the police to prove that pictures were contained on the computer. However an independent view might well lend weight to a defence argument that the files were downloaded unwittingly and the user had made every attempt to delete them immediately. Traditionally the defence would have to employ their own expert to make the assertion and a confrontation of experts is neither helpful nor beneficial in seeing either as balanced. Digital Techniques has been striving for the single joint expert for some time and its experts have been appointed in such roles many times. Experience and true independence are factors which have lead to a significant customer base and a level of creditability of which we are naturally proud.
Well it is not a free service but on the other hand we believe that it can be extremely cost effective. In addition to Court work we are often instructed by clients who feel that they have much to gain by a more comprehensive understanding of the facts surrounding a case. Over the years we have saved our clients vastly more money than we have charged in fees. We charge on the basis of an hourly, daily, or weekly rate depending upon the nature of the work to be undertaken. The majority of commissions are for cases running in the High Courts of London but regional High Court and County Court rates also apply. We do not undertake instructions where the fee is related to resultant savings but are happy to give estimates where appropriate.
For an informal, no commitment, discussion about your requirements please feel free to contact us by email or online as well as traditional telephone and fax.
|
ø Home ø Online enquiry ø Services ø Year 2000 ø Civil litigation ø Fees ø Contact us ø |