When a computer incident occurs, the correct and timely response is critical to ensuring that the evidence acquired will be admitted in any subsequent legal hearing. Computer examinations are usually undertaken using a copy of the original media; this copy is commonly known as an image or a forensic image. Using an image protects the original media from any changes and ensures that any processes applied during the examination can be repeated. Our forensic experts all have military and commercial investigations, computer forensics and computer auditing backgrounds. Additionally, they have considerable experience in dealing with computer incidents working both for the defence and the prosecution.

Computer Incident - Action Plan

When faced with a computer incident, the immediate actions for those at the crime scene will depend upon a number of matters including the nature of the case, the types and roles of the computers and the installed operating systems. No two cases are the same, however, a summary of the general procedures for crime scene attendance are:

• Take photographs of the computer screen and scene
• Either close the computer down or pull the plug
• Isolate the computer along with any associated computer media (including back ups)
• Acquire an image of the target computer media using forensic software and write blocking equipment.
• Examine the image not the original computer media.

There are times when a live examination of a computer system is the only option, however there are also procedures for this to ensure any acquired evidence is admissible in any subsequent legal hearing.

Further Information

Griffin Forensics provide a 24/7 computer incident, crime scene attendance and advice service, either acting with legal teams supported by court orders, or working directly for a business to identify if a suspected computer incident has, or may have, occurred. We are able to investigate the forensic images at our offices or, if preferred by the client, on-site. If you require further information about our computer incident or crime scene attendance services, or we can assist or advise with a computer incident, please call 01327 856010 or Email info@griffinforensics.com.