Page last updated on Wednesday, May 25 2005 at 1123 UK

Data & Evidence Recovery

Even deleted information can be recovered from computer systems

What is it all about?

Recovering information from computers and storage media which has been destroyed, damaged or tampered with. This includes the recovery of data from equipment which has been physically damaged.

Why is it important?

Because of their range of everyday use, computers often hold revealing evidence of a person's actions. This can prove invaluable in civil or criminal investigations and can be pivotal in establishing motive, method and ultimately guilt or innocence. Data can usually be recovered from computer systems even after extensive attempts to delete or hide it. Even severe physical damage can leave behind sufficient trace elements from which to reconstruct useful evidence.

The Problem

Because of the ease with which computer-based data can be manipulated, great care must be taken during recovery and analysis to ensure that forensic handling procedures are properly observed. Without such diligence, an accused party might justifiably claim that the evidence is unreliable and inadmissible. These procedures include using the correct methods for seizing computer equipment and the use of approved analytical software tools by properly qualified specialists.

The use of correct handling procedures becomes even more important when evidence has been intentionally modified or deleted. Recovery and reconstruction in such cases is often possible but only with the correct expertise and preparation. One of the most common barriers to successfully recovering evidence is the inappropriate handling of computer equipment before it reaches a forensic specialist; the key is to involve a TKM data recovery expert at the earliest opportunity.

The Solution

Retrieving electronic evidence in a format which is both usable and forensically sound requires immediate specialist involvement. Early consultation with an TKM forensic computing expert will provide you with sound advice on what to do straight away to increase the likelihood of successful data recovery.

Usually, this immediate advice is given by telephone and followed-up within 24 hours by a visit from the same recognised TKM forensic specialist, who can secure the evidence and begin detailed analysis using approved forensic tools and procedures. The process concludes in the presentation of a full report, complete with exhibits, which conforms to the highest standards required by law enforcement agencies and Courts around the world.

If you choose to persue criminal or civil recourse, TKM's reporting standards and expert testimony will provide a reliable basis for your case.

Print page Print this article