Forensic Analysis Intervention Methodology
We describe below the sequence used by the INSIDE Forensics Division for carrying out data analysis activities, from the assignment of the task to the final report:
- Identification: to begin with, all potential sources of data that can provide valid evidence presentable in court are identified and an appropriate work plan is devised.
- Acquisition:digital data should never be accessed without proper tools and procedures, due to the risk of invalidation or inadmissibility of the evidence presented in court. Digital information is fragile and can easily and/or inadvertently be altered by unqualified persons, even merely by switching on the device on which is stored.
The intervention methodology used by the INSIDE Forensics Division ensures that the data is acquired without any alteration and/or damage. A duplicate forensic copy of the data is made and its integrity is checked using hash functions. All the operations are adequately documented to ensure a proper chain of custody.
- Extraction: INSIDE works on the forensic copy acquired to extract the data and information contained in this perfect copy of the storage medium under analysis. Our extraction process ensures the recovery of deleted files, hidden files, temporary files, file fragments and other information stored on various devices such as personal computers, servers, mobile phones, smart phones and navigation systems.
- Data analysis: once the information has been extracted, it is analysed to reconstruct the activities carried out with the digital device. A final report is then prepared containing all relevant information, which can be used for internal appraisals within the company or in court.