Computer Forensic Investigation & Computer Expert Witness Service

A useful guide for Solicitors or others in the appointment of a Computer Expert Witness or Forensic Computer Investigator is given below. We also briefly describe the techniques we employ. All our Forensic reports are Peer reviewed by a separate party prior to submission.

The primary purpose of our forensic computer investigation is to translate the evidence found on computers into an readily understandable format for enabling informed decisions to be reached by the Solicitors, Barristers and Courts.

Forensic analysis of computers follows the first rule of any forensic investigation... First, Do No Harm. We have gained expertise in the data capture and analysis of computers so as to preserve the original computer evidence in a forensically sound manner acceptable to the courts. We utilise the same software as Law Enforcement agencies.

Expert Witness Reports and Legal Support Services

Apex Technology in conjunction with our partners at Pearson Professional Services provide a variety of litigation support services in cases involving personal computers and the Internet. All our reports are peer reviewed by experts in forensic computing, prior to submission.


Our Expert Witness and Computer Forensic Service Includes ...

- Capturing computer evidence in a forensically sound manner, including on-site capture where necessary.
- Study of Personal Computers (primarily via ENCASE software).
- Email and document investigation for dates, linguistic patterns.
- Interviews with witnesses, defendants or prosecution.
- Review of all case documentation.
- Compiling a Forensic analysis report for submission to the Solicitors or other bodies as required.
- Meetings to assist Counsel with understanding the nature of the computer evidence and how it supports or belies    the Defendant's statements.
- Court attendance as an Expert Witness to explain the Computer Foresic analysis
- Assist the court in understanding the nature of the Computer Evidence in relation to the case.

The Raw Data Acquisition & File Time Stamps

The analysis we provide during the forensic investigations commences with the acquisition of the retained data held in the personal computer. This raw data, and the very important time stamps provide clues to the who and when and where questions of the investigation. This is rather like analyzing fingerprints in a traditional forensic case, with the advantage we can tell the time each fingerprint or action was committed.

The file timestamps trace the progress and series of actions. They may provide an insight into the users motives.

If evidence is not handled correctly it may be ruled inadmissible.

Computers are volatile, and the inexperienced investigator, or "helpful" IT technician can easily change the time stamps so 'smudging' the evidence, and leave it in an unacceptable state. They must be preserved, and through our experience we can ensure that they are preserved during the forensic data capture.

Investigation and Analysis of The Data Mountain

Computers store a huge amount of data. Even the modest desktop computer in your home or office can store the equivalent of libraries of information, and would take years to view it all. To the casual observer it would be like finding the proverbial needle in a haystack. We have developed the experience to analyse the data in a timely manner, to find the 'needle' which provides the handful of clues leading to:-
a. Identity
b. Psychology
c. Objectives
d. Motives


Analysis of the Data

While the data on its own can report the actions that have taken place, this forms only part of the report we provide. Every case is different, and the correct application of techniques will determine whether the Computer Forensic report explains or confuses it audience. The techniques range over such things as:-

a. Check for changes in linguistic patterns between files created before, after and during the alleged offences.

b. Establishing the 'scene of habitation' as a backdrop to the period of the crime.

c. Providing chronological analysis and graphs for visual interpretation where necessary to illustrate a point.

Through our experience at Apex Technology on a variety of cases we pride ourselves on the quality and punctuality of our reports, which undergo a Peer review with a close partner company Pearson Professional Services Limited.


And for those with a questioning mind, the word Forensic.

The word Forensic comes from the Latin forensus, meaning of the forum.

1 In ancient Rome, the forum was where lawmaking debates were held, but it was also where trials were held just like modern day courthouses. From that, forensic science has come to mean the application of the natural and physical science to the motion of matters within a legal context

2. Forensic Science can be viewed as a tripartite structure consisting of
a. Collection, which pertains to the science investigation
b. Examination, which pertains to the investigation and,
c. Presentation, which pertains to the courts.

A forensic case will involve all aspects of each of the three structured elements.

We have undertaken Computer Forensic investigations throughout the UK from Brighton, London, Birmingham and Manchester.

Computer Forensic Analysis, and Computer Forensics Expert Witness covers the following areas
Brighton, London, Manchester, Birmingham, Oxford, Staffordshire, Shropshire, Cheshire, Derbyshire, North West, West Midlands, Walsall, Wolverhampton, Stafford, Newcastle under Lyme, Stoke on Trent, Stone, Burton on Trent, Lichfield, Shrewsbury, Telford, Newport, Cannock, Rugeley, Uttoxeter, Keele, Trentham, Blythe Bridge, Cheadle, Barlaston, Festival Park, Hastings, Welwyn Garden City, Hertfordshire, Tamworth, Bedford, Cambridge, Northampton, Milton Keynes, Cambridgeshire, Peterborough, Leicestershire, Lincolnshire, Middlesex, Norfolk, Great Yarmouth, Lowestoft, Northamptonshire, Nottinghamshire, Warwickshire, Atherstone, Stevenage, Luton, Hemel Hempstead, Glasgow, Scotland, Edinburgh, Fort William, Dundee, Perth, Stirling, Paisley, Dumfries, Elgin, Peterhead, Fraserburgh, Oban, Basildon, Romford, Chelmsford, Benfleet, Southampton, Edgbaston, Islington, Macclesfield, Bridgnorth, Bradford, Sheffield, Leeds, Yorkshire, Fife, Kircaldy, Suffolk, Thetford, Bury St.Edmunds, Ipswich, Newcastle upon Tyne, South Shields, Sunderland, Northumbria, Middlesborough, Hartlepool, Preston, Darlington, Rotherham, Penrith, Workington, Lancaster, Durham, Barrow in Furness, Gateshead, Carlisle, Teeside, Stockton on Tees, Erith, Kent, Ashford, Northhants, Wellingborough, Northamptonshire, Bristol, Swindon, Bournemouth, Plymouth, Hastings, Maidstone, Southend on sea, Aberdeen, Inverness, Bridgnorth, Flakirk, Cardiff, Swansea, Chester, Liverpool, Blackpool, Aberystwyth, Wrexham, Carmarthen, Hull, Norwich, Gloucester, Bridgend, Torquay, Bath, Cantebury, Portsmouth, Exeter, AbuDhabi, Dubai, Sharajah, Belgium, Epsom, Surrey, Northern Ireland, Belfast, Dublin, Londonderry, Armagh, Cork, Eire