How digital investigators gather evidence and solve crime with social media

Social media can be a great tool to document our daily lives, and when it comes to solving crimes, law enforcement officials and digital investigators view it as a valuable tool, too.

Who & How

An survey showed that majority use social media for several reasons:

1. Identifying people
2. Gathering evidence
3. Discovering criminal activity and locations
4. Community outreach
5. Soliciting crime tips
6. Notifying the public
7. Recruitment

People put a great amount of personal, detailed information online. Targets even brag and post illicit valuable information in reference to travel, hobbies, places visited, functions, appointments, circle of friends, family members, relationships, actions, etc.

The networks most used by law enforcement officials and digital investigators:

- Facebook
- Twitter
- Youtube

Some social media platforms can reveal more information than others.

DLA combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to acquire the digital evidence that you desire.

Emergency Guide: The Do’s and Do Not’s of Computer Forensic Emergencies

Read this vital guide on saving evidence in Computer Forensic Emergencies…

DO – Make detailed noted on all activities
> Collect data that would otherwise be lost by removing the power supply.
> If the device is switched on, record what is on the screen by taking photos or by making a written note of the content.
> Ensure that actions or changes made to the system are recorded. > Ask the user about the setup of the system. E.g. Passwords, usernames etc.

DO NOT – Switch on the computer

> Every time a computer is switched on data can be changed
> Make sure that the computer is switched off
> Look for activity. E.g. lights may indicate power/activity. Remove the main power source battery from laptop computers

DO – Unplug the device to ensure information cannot be overwritten
> A computer in sleep mode may be accessed remotely, allowing the alternation or deletion of files.
> Remove the power supply from the back of the computer without closing down any programs. This avoids any data being written to the hard drive with power loss.
> Remove all other connection cables leading from the computer, and make notes.

DO NOT – Continue to use the computer device
> After an incident has been established, continued usage of the computer device could prove devastating to the existing evidence.
> Deleted data can still be present on the machine, but marked as ready to over-write. Use of the computer overwrites existing data on the hard drive which could hold important evidence.

DO – Secure or seal the system in a locked cupboard or container
> By securing the computer, this can restrict any unauthorized access to the computer, which minimizes potential data loss.
> This also provides a level of protection from natural hazards or accidents that may occur around the device and cause damage to the system.

DO NOT – Let your IT department or computer specialists “have a quick look”
> Without the use of special digital forensic software and tools, tampering with the evidence can cause data to be lost or corrupt.
> Commercial “Data Recovery” software does not work for evidential purposes and could result in data loss

DO – Call us right away
DLA has grown to become a great provider of digital forensic services in Cape Town and nationwide. We pride ourselves on offering the highest quality digital forensics and delivering thorough, detailed and accurate results.  Contact us today and we can provide you with the digital evidence that you need.

Recover computer evidence quickly and easily!

People use their computers for almost everything; many of these things can be used against you. Hiding money, illegal activities, inappropriate emails and just about anything you can think of.

Often, if you are trying to hide something, you’ll make an effort to completely clean out your computer by deleting “everything” and reformatting. The problem is, when you contact IT support and you are told that all is lost, they probably have no idea what a digital forensic investigator can do!

The harsh truth is that the evidence is still there, waiting to be found, you just can’t see it. The only question is, do you want it recovered or not.

Many businesses that have a disgruntled employee, or feel that an employee is involved in unacceptable activities at work, may want to acquire some digital evidence, they can use a digital forensic investigator to recover all the evidence that they need.

We at DLA are pleased to provide all the evidence that you need off of a computer, cellular device, laptop or tablet. The obvious advantage that we have here at DLA is that we recover digital evidence that few others could and keep all affairs private.

Need something recovered? Don’t hesitate to give DLA a call.

How do I save my WhatsApp chat history?

Saving your WhatsApp messages is a relatively easy thing to do, and although it is possible to recover your WhatsApp history if it is ever lost, it’s better to just save them from the beginning to avoid problems later. Here’s how:

Your WhatsApp messages are automatically backed up and saved on your phone’s memory on a daily basis. If WhatsApp is uninstalled and you don’t want to lose any of your messages, make sure to manually back up your chats before uninstalling.

1. Open WhatsApp and go to Options > Settings > Chat History > Backup chat history.

2. Press Yes to back up your chat history.

If you are deleting and reinstalling WhatsApp, you will be asked to import your backup after you first open your new copy of WhatsApp. Simply press Restore and your chat history should begin to load.

If you need to transfer your chats from on phone to another, transfer your SD card to your new phone before installing WhatsApp. If you do not have an SD card, you will need to copy the whole “wa” folder from your old phone onto your new phone’s memory. Install WhatsApp and click on Restore when you see it, and your chat history should begin to load.

Here’s some useful technical information you may want to know about your backup:

- Backup files are saved in the “wa” folder and are called MsgStore.bak.

- Backup files are saved to both your phone’s internal memory and SD card, but only given that there’s enough space.

- Backup files are only valid for 7 days after the last save. Make sure you import your chat history before it expires!

- Backup files are phone number sensitive; they’ll only work with the same phone number.

- Backup files are saved in a format to be opened with WhatsApp. If you want to read your conversations on your computer, you can send them as .txt files from WhatsApp to your email.

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require. We do many services, from data and WhatsApp history recovery to image and CCTV enhancement.