Shashvathi Forensic Lab provides Computer Forensics services involving the examination of computers and digital storage media to identify, preserve, analyse, and document potentially relevant digital evidence.
Computers and storage devices may contain important information relating to cyber incidents, unauthorised access, data theft, suspicious activities, employee misconduct, document disputes, and other investigations. A structured forensic examination can help recover and analyse available digital artefacts while maintaining appropriate evidence-handling procedures.
Our examination scope may include desktop computers, laptops, hard drives, solid-state drives (SSDs), USB storage devices, and other supported digital media, subject to the nature of the assignment and the technical condition of the evidence.
What Is Computer Forensics?
Computer Forensics is a specialised area of Digital Forensics concerned with the identification, preservation, acquisition, examination, and interpretation of digital evidence from computer systems and storage media.
The process may involve examining file systems, user activity artefacts, system logs, documents, browser records, installed applications, and other relevant data. Depending on the circumstances, the examination may also identify deleted files or traces of activity that remain recoverable.
The findings depend on the device condition, operating system, encryption, data availability, evidence preservation, and the scope of the examination.
Scope of Computer Forensics Services
Shashvathi Forensic Lab may undertake the following activities, subject to the available capabilities, evidence, and agreed scope of work:
- Digital Evidence Acquisition: Acquisition of data from supported devices using appropriate forensic procedures.
- Hard Drive and Storage Media Examination: Examination of supported HDDs, SSDs, USB drives, and other digital storage media.
- Deleted Data Recovery and Examination: Assessment and recovery of deleted files or data remnants where technically possible.
- File and Document Examination: Analysis of relevant electronic documents, file properties, timestamps, and associated artefacts.
- User Activity Analysis: Examination of available artefacts relating to computer usage and user activity.
- Browser and Internet Activity Examination: Review of available browser history, downloads, and related artefacts.
- System Log Examination: Analysis of relevant operating-system logs and event records.
- Malware and Suspicious Activity Assessment: Examination of available artefacts associated with suspected malicious activity, where included in the scope.
- Data Integrity and Hash Verification: Calculation and comparison of cryptographic hash values to assess whether digital files or forensic images remain unchanged.
- Technical Report Preparation: Documentation of the procedures performed, findings, limitations, and relevant observations.
The exact services undertaken depend on the device, operating system, available data, technical requirements, and the laboratory's examination capabilities.
Computer Forensics Examination Methodology
The examination process may include the following stages:
- Initial Consultation: Understanding the incident, investigation objectives, and specific questions requiring examination.
- Evidence Identification and Documentation: Recording available information about the device, its condition, and the circumstances of submission.
- Evidence Preservation: Taking appropriate measures to minimise changes to the original evidence.
- Forensic Acquisition: Creating a forensic image or acquiring relevant data using suitable procedures, where technically possible.
- Integrity Verification: Using cryptographic hash values, where applicable, to verify the integrity of acquired evidence.
- Forensic Examination and Analysis: Examining relevant files, system artefacts, logs, and other available digital information.
- Interpretation of Findings: Evaluating the recovered information in the context of the agreed examination objectives.
- Report Preparation: Preparing a technical report documenting the methodology, findings, and limitations.
Not every examination requires every stage. The procedures adopted depend on the evidence type, device condition, technical feasibility, and the scope of work.
Evidence and Information Required
For a computer forensic examination, the following may be requested:
- The computer, laptop, or relevant storage device, where available.
- Details of the device make, model, operating system, and storage media.
- A description of the incident or issue requiring investigation.
- Specific questions or objectives to be addressed during the examination.
- Relevant dates, usernames, file names, or other known indicators.
- Available access credentials or decryption information, where lawfully authorised and necessary.
- Written consent, proof of authority, or other applicable authorisation for examination.
Evidence preservation: Avoid using, resetting, formatting, or reinstalling the operating system on a device that may contain relevant evidence. If the device is involved in an active incident, seek appropriate technical guidance before taking action, as the correct handling procedure depends on the circumstances.
Who May Require Computer Forensics?
Our services may be relevant to:
- Businesses investigating suspected data theft or unauthorised access.
- Organisations conducting internal investigations.
- Advocates and legal professionals requiring digital evidence examination.
- Individuals involved in computer-related disputes.
- Corporate security and incident-response teams.
- Investigators examining suspicious computer activity.
- Clients requiring technical examination of digital files and storage media.
Importance of Computer Forensics
Digital evidence can be relevant to understanding what information is available on a computer system and whether particular activities may have occurred. A forensic examination can help identify relevant artefacts, establish documented observations, and assess evidence in relation to defined investigation objectives.
Proper preservation, documentation, and integrity verification are important for maintaining the reliability of digital evidence. However, the presence or absence of a particular artefact does not always establish conclusively that an event occurred or did not occur. Findings must be interpreted in light of technical limitations and other available evidence.