What is Forensic Data Recovery?

Forensic data recovery is not magic; in fact it is actually very technical. People always wonder how the forensic experts can conjure up stuff from smartphones, tablets or hard drives that the owners thought were gone. So, how does forensics data recovery work?

Sometimes forensic data recovery is as simple as trying to reconstruct the information on a damaged hard drive, disc or memory card. At other times, it may include the resurrection of data that was thought to be lost or deleted, the bypassing of security systems or the study of a smartphone for traces of certain activity.

Because specialists in forensic data recovery may be working with computers which have been seeded with safety measures to prevent legal investigations, they must use special procedures to avoid compromising or erasing data.

Forensic data recovery is not magic at all. It is highly sophisticated and in order to be admissible in court, must be completed by professionals using complex tools and protocols.

DLA digital and cellular forensics can find the data that you need! DLA knows forensics inside and out, so if you need a professional when it comes to any forensic data recovery - Contact DLA now!  

Your video may prove guilt to you, but not in court

Because of the constant flood of easily accessible technology, security cameras seem to be more plentiful than ever before…

- Many private residences now install security cameras around the exterior of their property.

- Business owners install cameras in work areas and entrances.

- Parents with children often install surveillance equipment to keep tabs on the safety of their children with caregivers.

Those constantly rolling cameras can often hold people accountable for bad behaviour. In the event of videotaping a suspected criminal, people have a false security about their video skills. You might assume that you don’t need the services of professionals like DLA digital and cellular forensic investigators, after all, you can do it yourself, right? You will change your mind after you read what goes into providing video evidence for court…

- When you review a video to make sure you have clearly caught a crime on tape, don’t just immediately decide that dark footage is useless. Actually, dark footage is easier to enhance than overexposed footage.

- Immediately confiscate the equipment used for the video. If the event was recorded through the use of a camera phone, home camcorder or a security camera, immediately turn this equipment and video over to the proper authorities.

- Quickly make a decision about how you wish to allow the footage to be rewound and repeated. In a court trial, jurors may not be as shocked by a crime caught on video if they repeatedly view it.

- If at all possible, involve a video expert experience in evidence handling to be involved with the set-up and operation of the equipment. This person is not only easily accessible for computer glitches. But also, the presence of a legal video expert gives you credibility.

In order for video evidence to be admissible in court, it must comply with the proper recording and preservation guidelines. You might know you have evidence, but you might not be able to use it like you think.

If these important tips have made you question whether you are capable of producing the required evidence of wrongdoing or to prove innocence, it’s time to call the professionals at DLA! 

Mobile Phone Analysis

Mobile devices are becoming increasingly powerful and popular, with people even sometimes carrying more than one. However, their increasing capability provides more opportunity to store and circulate information.

Mobile devices have many different features, like the ability to take photos and videos. When a multimedia file is taken, many devices automatically embed GPS location of the handset at that time. This then allows the location of the user at that exact moment to be established at a later date.

Multiple communication features, such as Bluetooth, WiFi 3G and 4G enable the transfer of information that can even cross international boundaries. Users can browse the internet, send and receive emails, post blogs and even removable media cards can be inserted into the device allowing information to be exchanged.

Depending on the client, the following information can be recovered from a mobile phone:

- SMS
- Email
- Call history
- Photos
- Videos
- WhatsApp history
- Passwords

Mobile devices are similar to computers, but with far more powerful capabilities. The value of the evidence found on a smartphone or any other mobile device must never be overlooked! DLA has the cellular and digital expertise to extract and uncover the evidence you need.

The other side of mobile forensics

Mobile or cellular forensics isn’t just about finding WhatsApp messages, images and recent calls; it can also reveal much more. There’s a whole other side to it, which can include carrier data, call logs, undelivered messages and important data that reveals your exact location at the time of the incident. Matched together with the information saved to your mobile device, and mapped together with street names and landmarks, carrier data can enhance data on your device.

The best thing is, if cellular forensics is being used in an important crime case, they can be used to break the case. However, a lot of investigators overlook this critical evidence.

Most cell towers consist of poles that send and receive signals in three sectors; this makes it easier as it enables them to identify which side of the tower communicated with a cellular device.

Carriers keep detailed call records of these communications for billing purposes, so the data includes information like date, call length, whether a call was inbound, outbound, or went to voicemail.

Tower data reveals whether the device was in motion or stationary. A person dialing from one location will hit the same side of the same tower, but a person on the go will hit different towers and different sides.

In an investigation that uses mobile forensics, carrier data information can be vital. It can be used to place a phone in a certain area at a specific time, identify call patterns, establish timelines and identify suspects. 

DLA is based in Cape Town and combines the experience of two seasoned investigators with both criminal and civil backgrounds with the latest technologies to achieve the results that you require. Contact us today today!

What is a forensic audit, and why do they require digital forensic services?

Here at DLA, some of our top clients include forensic auditors, as they require our digital forensic services for their forensic audits. But what exactly is a forensic audit and what does it mean?

Read on to explore and find out what a forensic audit is, when they are used and how they are used in court…

A forensic audit may sound like something quite exciting that you’ve probably heard on crime dramas like CSI and Law and Order, but the truth is, it is a little more boring.

A forensic audit is the process of reviewing person’s or companies financial statements to determine if they are correct and lawful. Forensic accounting is most commonly associated with tax audits, but can also be commissioned by private companies for digital forensic investigations.

So, when are forensic audits used? Forensic audits are used wherever an entity’s finances present a legal concern. For example, it is used in cased of suspected embezzlement, fraud, to investigate a spouse during divorce proceedings and so much more. This is where digital forensics comes in; our services are specifically designed to help forensic auditors in these cases.

Forensic audits are performed by a class of professionals with skills in both criminology and accounting, so they specialize in following a money trail, keeping track of fraudulent and actual balance sheets and checking for mistakes in income reports and expenditures. If they find any discrepancies, it may be the forensic auditor’s job to investigate and determine the reason for it, with the help of a digital investigator if digital evidence is needed!

How are forensic audits used in court? They are presented as evidence by a prosecutor or by a lawyer representing an interested party. Because finance is so complicated, the way a forensic auditor will describe a company’s financial position is often very precise. Because of this a prosecutor or lawyer will call an expert witness to explain the forensic audit in simpler terms in order to build a case.

Forensic audits cover a wide range of activities, and they can be a part of many different investigations, digital forensic investigations being one of them.

Uncover the truth about your data with cellular forensics

A few years ago, the main source of truth came from email servers. These days, work communications have elvolved and are not limited to just laptops and PCs. They have burst onto the scene with WhatsApp messages, instant messaging and mobile sharing apps.

So, where is your data going? And where is it stored?

79% of business users use SMSs or WhatsApp messaging for business communications. Those text messages can pose a significant risk.

60% of those that allowed SMSs or WhatsApp messaging had minimal or no confidence in their ability to produce messages if requested.

Outside of audits, litigation and e-discovery requests are the #1 reason digital communications data is leveraged.

Standard questions legal has for IT during discovery of data:

- Where is the backed up data stored?
- What are our retention and archival policies?
- How is the company currently backing up the data stored on laptops, PCs and mobile devices?
- Which devices (Windows, iOS, Android, Linux) are in use?
- How do we manage data belonging to ex-employees?
- How does our existing software handle and implement data privacy and confidentiality policies?
- Can we collect and preserve delete messages?
- How can I monitor messaging communications on mobile devices for adherence to regulatory mandates or internal compliance policies?

With cellular forensics, IT can:

- Give legal information about the company’s data assets
- Educate legal on all the software IT uses to manage data
- Look for opportunities for IT to identify and collect data that can facilitate repeatable collections and reduce spoilage risk.

SMSs and instant messages are increasingly an issue in investigations. But by extracting them from cellular devices can be expensive and time consuming if you don’t know what you’re doing. Contact DLA Cellular and Digital Forensics and we can follow the digital trail on your cellular or digital device to get the evidence that you need.

The Different phases of a Computer Forensics Investigation

Here are the following steps investigators should follow to retrieve digital evidence…

1. Secure the computer system to ensure that the equipment and data are safe. This means digital investigators must make sure that no unauthorized individual can access the computers or storage devices involved in the search.

2. Find every file on the computer system, including files that are encrypted, protected by passwords, hidden or deleted, but not yet overwritten. Digital investigators should make a copy of all the files on the system. This includes files on the computer’s hard drive or in other storage devices.

3. Recover as much deleted information as possible using applications that can detect and retrieve deleted data.

4. Reveal the contents of all hidden files with programs designed to detect the presence of hidden data.

5. Decrypt and access protected files.

6. Analyze special areas of the computer's disks, including parts that are normally inaccessible.

7. Document every step of the procedure. It's important for digital investigators to provide proof that their investigations preserved all the information on the computer system without changing or damaging it.

All these steps are incredibly important in a computer or digital forensics investigations, make sure you follow them all to ensure an effective investigation.

DLA Digital and cellular forensics can provide you with the digital evidence that you need! Let us follow the electronic trail to find and protect the evidence that you need.