Page last updated on Thursday, May 4 2006 at 1536 UK

On-Site Services

On-site and covert services for capturing data and extracting evidence

TKM Technologies’ range of services for analysing the information stored on computer systems and removable media is not just confined to our laboratories. Sometimes, it is better to leave the suspect systems in place and have the laboratory come to you. This is especially true where discrete, covert data capture stands a better chance of producing evidence.

Because on-site computer forensics relies on having suitable facilities available in an unfamiliar location at a specific time, careful planning is needed to make sure that an investigation can go ahead as scheduled. Consideration must be given to timing, equipment compatibility and premises access.

Capturing the Evidence

Capturing evidence on-site presents unique challenges which must be met. Our high-capacity mobile imaging systems provide the same level of evidential protection as those used in our laboratories. They support a variety of interfacing standards to enable us to connect to your computer systems and they are specifically designed to complete the imaging stage of an investigation quickly and efficiently.

The performance of our mobile forensic facilities makes them ideal for situations where you need suspect computer systems to be imaged covertly. We are often asked to complete large-scale imaging operations outside office hours and this can involve duplicating thousands of gigabytes of data from multiple computer systems overnight.

Removable Storage Media

Removable media is often used to transfer or backup data and it can contain valuable evidence. It also presents unique challenges for imaging, principally because there are so many different types of media and each type needs its own set of hardware.

To accommodate the different types of magnetic disks, backup tapes and other storage media, our mobile imaging systems can be fitted with a wide array of drives and readers. This usually allows us to complete the entire imaging process on-site, without having to send your media back to our laboratory.

How we Plan On-Site Forensics with You

During our initial briefing with you, we will ask you to provide information about the sort of equipment you want us to examine. We understand that you won’t necessarily have all the technical details but a little information is better than none and it all helps us to decide what sort of equipment we need to bring on-site.

We will also discuss timing and premises access with you. We will need to know where the forensic examination is going to be carried out and what sort of premises we will be working in (for example, commercial offices, a factory, a ship etc.). We will need to know whether a member of your own staff will meet us on-site or whether we will be working unaccompanied; this will also determine the arrangements for exchanging keys and security access codes for alarms and doors.

Equipped with this information, we will confirm our proposal to you in writing and let you know exactly what we plan to do. With your approval, we will travel to site and complete the investigation as planned.

If you have asked us to analyse the data on-site, we will do so; otherwise we will return the forensic images to our laboratory, where we can search them for evidence more efficiently.

Print page Print this article