Acquisitions and Advice

The acquisition (or imaging) of electronic device data is like freezing the electronic crime scene at a point in time. If you suspect foul play, deception, misuse of computer equipment, fraud or the like, and you think there is any chance that electronic devices may hold evidence, then the best action is to go ahead and secure forensically sound images of the devices as soon as possible.

If you are not sure what devices may be involved, then we are happy to discuss the situation with you in confidence, and work with you to determine what may need imaging.

We use a range of proven device imaging software, hardware write blocking devices and hash calculations to assure that the data acquired is an exact image of the original, without risk of the original being modified during the process.

In a business environment, it is normally important that the imaging process is carried out as quickly as possible, so normal business operation can continue as soon as possible. We will work with you to minimise the impact without compromising the evidence.

Different devices and different computer operating systems command different strategies and different tools. If a computer is turned on, do you turn it off, or do you leave it on? Turning a computer off may deem it useless, as may leaving another one on. We are aware of the traps and can share our experience with you.

There are many reasons why a company's IT department is not suitable for collecting electronic evidence. While they may be able to image a hard drive, will they use forensically sound methods? Will the acquisition stand up in a court of law? Do they know what a chain of custody is? Is someone in the IT department involved in the matter?

Where obscure devices may be involved, we can draw on the experience or other certified examiners (from around the world), in order to make sure the the correct tools are obtained and competently used for the specific device.