Computer forensics, or digital forensics, as it is more broadly known, involves analysing IT systems to find information to solve cyber crime, and, more generally, crimes committed using a computer, crimes targeting computers or cases in which computers and the data on them can be a source of evidence.
The main purposes of digital forensics are:
- Acquisition of data without altering or modifying the IT system on which they are stored, ensuring any data copied to another medium are identical to the original
- Forensic analysis and evaluation of acquired data;
- Reporting on the scientific methods used and the results obtained for legal purposes.
Forensic investigations can involve personal computers, notebooks, smartphones, servers, tablets, virtual machines, databases, images, videos and audio in digital format, websites, e-mail, telephone records and all other digital media and data.
Only a few, well-established digital forensics entities (freelancers and companies) currently operate professionally in Italy. The ability to combine data recovery techniques with the forensic analysis of computers and devices as part of legal proceedings is one of the key factors to success in this field.
Today, virtually all court cases make some use of digital data: whether it is for separations, tax disputes, injunctions or murder trials.
Digital forensics applications can range from the “simple” recovery of information from digital storage media to more in-depth data analysis.
The many cases mentioned in the media that use digital forensics involve paedophilia and child pornography, stalking and cyberstalking, libel on social networks, cyberbullying among adolescents.
More generally speaking, digital forensics techniques are used to collect solid, essential evidence from digital media. An expert appraisal meets the requirement of methodological precision to ensure the best results, without losing data.
Unfortunately, data loss often occurs with professionals who don’t have the requisite skills and training or when unsuitable software or equipment are used, and can invalidate the probative value of evidence, or lead to its exclusion.
Digital forensic procedures and tools for data recovery and analysis
It is essential that the procedures used in digital forensics are rigorous enough to ensure the integrity of the recovered data. Any copies must be perfectly identical to the original material found on the device or medium analysed (known as a bit-to-bit copy or bit-stream image). To achieve this we use certified tools, including special equipment such as write blockers and hardware duplicators, which make direct copies of digital media that have been seized or are submitted for analysis by the owner.
At the end of this process, a digital forensic report is drawn up to accompany the certified copies for use in court.
The main issue faced by digital forensics experts is ensuring integrity. It is essential to demonstrate that there has been no manipulation of the structure of the storage medium and the extracted data, so that third parties (e.g. ex-parte consultants or court-appointed expert witnesses) can check the methods used and the results of the acquisition process. This prevents evidence from becoming inadmissible due to oversight or a poorly performed analysis by an unskilled or inexperienced analyst.
At our laboratory, we rigorously follow the guidelines for processing digital data and maintain a chain of custody for each medium processed.
Our qualified and fully trained staff handles each stage in the process with the utmost precision. They use the best digital forensic tools available on the market and validated according to the rules of international bodies like the NIST framework.
When it comes to our procedures, we offer an assurance of the highest standards from professionals with decades of experience in computer forensics cases, whether it is providing purely technical expertise or support during investigations and in court.
Choosing the best ex-parte digital forensics consultant
A quick web search will reveal that numerous professionals and companies offer IT and forensic analysis services. But for someone who doesn’t know this industry, it is hard to make the right choice.
So should you choose BIT4LAW for your digital forensic investigations?
BIT4LAW consultants have over 20 years’ experience in the industry, having worked on more than 1,000 criminal and civil cases in numerous ex-parte and court-appointed roles
BIT4LAW offers you not just one professional, but a whole team of consultants and lab technicians, ensuring maximum quality and definite response times to your requests.
These are the values that underpin the BIT4LAW philosophy: transforming the concept of precision into a standard of quality, in accordance with the law, the standards on computer forensics and privacy rules and with full transparency for our clients.
Call us on +39.051.0562070 or send an e-mail to firstname.lastname@example.org for a free estimate, or complete the form and one of our digital forensics consultants will get back to you.