Page last updated on Tuesday, April 4 2006 at 1540 UK

Laboratory Services

Laboratory-based services for extracting and analysing potential evidence from computer systems

TKM Technologies provides a full range of services for analysing the information stored on computer systems and removable media such as CD-ROMs and backup tapes. These start with capturing the raw data and go right through to extracting and presenting the evidence for (and against) a case.

Securing the Evidence

One of the overriding principals in a computer forensics investigation is that potential evidence must not be tainted. Examination of the data must not cause it to be changed in any way.

By using specialist software tools and procedures developed in-house, we first capture an identical copy of the source data in a process known as imaging. This copy includes information which might not otherwise be accessible, such as data which may have been deleted or old data which has been partially overwritten.

By working on this duplicate, rather than the original storage media, we can begin to look for evidence without any danger of damaging the original data. This procedure is the most widely accepted way of examining computer-based evidence and ensures admissibility in a Court of Law.

The easiest and most effective way to carry out this stage of a computer forensics investigation is by working on the original computer or storage media in our laboratory. Here, we have all the facilities which are necessary to complete this stage quickly and in full compliance with recognised best-practice.

It is also possible to capture evidence on-site and the viability of doing so depends on your circumstances and the condition of the equipment. We use sophisticated mobile systems to capture data with the same rigorous adherence to forensic procedure as our specialists apply in our laboratories and we will be happy to decide with you whether this is a realistic option.

Collating and Searching the Evidence

Having captured data from your equipment and storage media, the next step is to collate it into a case file so that it can be searched for evidence. Because data comes in so many different formats, we have developed technology and procedures for handling data from a wide variety of file systems.

Adding the captured information to a case file allows us to use a range of powerful search tools to locate potential evidence. Because time is so important in a forensic examination, our laboratories use the latest high-speed computers, running sophisticated search algorithms, to comb through thousands of gigabytes of data, including data which might have been deleted by a criminal to cover his tracks.

Our specialist investigators use the background information which you provide to the derive search terms which are most likely to yield evidence. This collaboration between human experience and data processing capacity produces results quickly and accurately.

Print page Print this article