Authority · exhibit handling · write blocker · imaging · hashes · examination · second tool · report
How a forensic examination works. Every step recorded, nothing done to the original, and a result another examiner could repeat.
What separates a forensic examination from ordinary data recovery is not the software; it is the discipline around it. The original is never altered, every step is recorded, the copy is proved identical to the original, and the method is one another examiner could repeat and reach the same result. That is what lets findings be relied on when they are challenged. This page walks through an examination in order, from the authority check to the report, and sets out the four principles of good practice it follows.
Rather talk it through? An engineer answers the bench line
0800 6890668
The examination, in order.
1. Authority. Before anything is done, we establish who owns the device and who is entitled to have it examined, and we see the proof: ownership, an employer's letter with the lawful basis, a solicitor's instruction, a court order or a grant of probate. The scope, the questions and the period, is agreed in writing.
2. The exhibit. On arrival the exhibit is given a reference, photographed, and its condition, seals and serial numbers recorded. Every movement from then on is written into the chain-of-custody record: who held it, when, and why.
3. Imaging behind a write blocker. The drive is connected to the imaging computer through a hardware write blocker, which lets data be read but makes it physically impossible to write to the drive. It is then imaged bit for bit, every sector including the unallocated space where deleted data lives, into a forensic image file. Where a damaged drive has to be physically recovered before it can be read, that intervention is recorded in detail.
4. Hashing and verification. A hash, MD5 and SHA-256, is computed for the original and for the image. Matching values prove the image is an exact copy. The hash is recomputed before the examination and again before the report; if it ever differed, the copy would be known to have changed.
5. Examination of the image. All examination is done on the verified image, never the original, and scoped to the agreed questions. The standard examination is produced with PassMark OSForensics: user activity and USB history, deleted-file recovery, the USN journal, Prefetch, event logs and the registry, email, document metadata, Volume Shadow Copies and a timeline. Personal material outside the scope is not reproduced.
6. Confirmation in a second tool. Findings that matter are confirmed in a second, independent tool, so a result does not rest on one program's interpretation. The tools and their versions are listed in the report.
7. The report. The standard report sets out the exhibit and its condition, the integrity record, the tools and method, the findings by category with tables and a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. The exhibit is returned sealed, or retained under seal, and the image is kept encrypted for an agreed period and then securely destroyed.
The four principles it follows.
The questions that come up first.
What is a write blocker?
A hardware device placed between the exhibit's drive and the examination computer that lets data be read but prevents anything being written. It means the act of examining cannot alter the original.
Why is the image hashed?
A hash is a mathematical fingerprint of the data; matching hashes for the original and the image prove an exact copy, and recomputing the hash before analysis and before the report proves nothing has changed since.
Is anything done to the original device?
No, save where a damaged drive must be physically recovered before it can be read, which alters the device's physical state but not the user data, and which is recorded in full in the report.
What software do you use?
The standard examination is produced with PassMark OSForensics, with key findings confirmed in a second tool such as Autopsy, and FTK Imager or a hardware imager for acquisition. Each report lists the tools and versions used.
Every step on the record.
Tell us the situation and who owns the device, and the first conversation will tell you what an examination can show and what it cannot.