Understanding The Science

Using proven methodology and software, the electronic devices are systematically examined in an effort to recover evidence that may prove or disprove that a certain event/situation has occurred. It may show that the event occured within the device or the device has been used to createa situation.

All examinations are carried out to the highest of standards, so that the results are evidentially sound and may be accepted in courts of law. Digital Forensics is the process of using scientific knowledge in the collection, analysing, and presenting of evidence in court. (The wordforensics means to bring to the court.) Forensics deals primarily with the recovery and analysis of latent evidence. Latent evidence can take many forms, from fingerprints left on a window to DNA evidence recovered from blood stains to the files on a hard drive.

Computer Forensics is defined as the discipline that combines elements of law and computer science to collect and analyse data from computer systems,networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law.

Why Use a Forensic Investigator?

Using sound computer principles and practices, you will help ensure the overall integrity and survivability of your network infrastructure. You can help your organisation if you consider computer forensics as a new basic element in what is known as a defence-in-depth approach tonetwork and computer security. Understanding the legal and technical aspects of computer forensics will help you capture vital information if your network is compromised and will help you prosecute the case if the intruder is caught.

What are some typical aspects of an investigation?

	Those who examine computers must understand the type of potential evidence that they are looking for in order to structure their examination. It should be noted crimes involving computers can range from child pornography to theft of personal dataand to the destruction of intellectual property.
	The investigator must be able to pick the most appropriate tools(s) to use for the examination.  Files may have been deleted, damaged, or encrypted, and the investigator must be familiar with an array of methods and software to prevent further damage and the inevitable recovery of the subject data.
	Be able to provided evidence that is admissible in a court of law.

What to look for when engaging in an expert?

	Computer and Cell Phone Forensic Experts are able to move quickly through the questioned media, identifying areas to look for evidence and also identify additional information sources. They will not damage, destroy or compromise evidence during theinvestigative process.  Because they have been trained to find evidence in an effective and efficient manner, the cost of the examination will be considerably reduced.
	The Computer and Cell Phone Forensic Expert will preserve the chain of custody in accordance with the accepted rules and then produce that evidence in court in a professional and easy to understand format.  They will also be able to explain in layman's terms, thecomplicated processes of how a computer works and how the evidence was obtained..
	A Computer and Cell Phone Forensic Expert will respect your private information and not divulge any privileged client-lawyer information that is inadvertently acquired during the examination process.
	With the  increasing use of computers and cell phones over the last two decades, the use of Forensic Experts will become more and more important.  It is imperative that the legal and professional fraternities know and understand the ramifications of notusing properly qualified experts.  These experts will point the professionals in the direction best suited for the matter in question or litigation process and will do so in a less time consuming manner than unqualified people.  The Forensic Expert should no exagerate whatinformation can be recovered from an electronic device.  Many new devices, such as Apple computers, iPhones and Tablets may not allow certain information to be recovered.  Because of the security features relating to Apple devices, the recovery of data has become morean more difficult.  These limitations should be spelt out to the client before they engage the forensic expert.
	The Forensic Expert will present the information in a manner that is recognised by the court system and will be able to explain the facts in an easy to understand manner.  An important question to ask the expert is whether he is recognised as an expert in the NewZealand Courts and whether he/they abide by the New Zealand Courts Rules for Expert Witnesses. A further question that should be asked of the Forensic Expert, is what qualifications do you have to conduct the requested examination and what certifications have you obtained that allows you to forenically examine a device using the hardware and software that you areusing.  Many companies and individuals use hardware and software and have had no formal training in the use of the hardware and software.