Computer Forensics Procedures
There are several procedures that eMag Solutions adheres to which ensures that all investigations are not compromised from the outset. These procedures include the identification and collection of computer media that may contain potential evidence. At eMag it is fundamental that thorough documentation including chain of custody logs and contemporaneous notes commence at this early phase of the investigation. All evidence is placed in sealed evidence bags and securely transported by an eMag employee, therefore providing a chain of custody from our client's site to eMag's secure evidence store.
Acquisition & AnalysisThe next stage in the investigation involves the 'acquisition' or 'imaging' of the original evidence to another piece of computer media. This means that a forensically sound copy or bit for bit image is taken of the media using specialist 'write-blocking' hardware and software. Once all the media has been acquired, a computer forensic investigator can begin a full analysis on the image.
The preliminary steps involved in analysing an image include the possible recovery of user inaccessible files, analysis of all file signatures to determine a file's true extension and the calculation of hash values, therefore generating a digital fingerprint for every file. Once these steps are complete the investigator can commence with the client's case objectives.
It is eMag's policy to regularly communicate with our clients providing progress updates on their case. A comprehensive computer forensic report and witness statement will be produced detailing the results of the analysis.