From the original source to a documented reconstruction.
A forensic analysis must protect the integrity of the evidence and make the path followed understandable. The activity is planned based on the question, the available sources, the volatility of the data and the legal or operational constraints communicated by the customer.
Main phases
- identification of sources and definition of the perimeter;
- forensic acquisition or documented collection of data;
- hashing, inventory, storage and chain of custody;
- analysis of file systems, metadata, logs, accounts and applications;
- recovery of deleted items when technically possible;
- temporal correlation and timeline construction;
- cross-checking between independent sources;
- technical report with evidence and limitations.
Possible questions
Analysis may involve access, program execution, copying of files, use of external devices, communications, administrative activities or alterations. Conclusions are formulated only when supported by sufficient evidence, avoiding automatically attributing an action to the person who owns an account or device.
Output
The customer receives documentation of the operations, list of finds, timeline and report. When requested, the results are illustrated to the appointed consultants in understandable language and with a clear indication of the degree of certainty.