Computers and workstations
Windows, macOS or Linux workstations, user profiles, files, history and system artefacts. They can help reconstruct usage, access, file copies or actions carried out over a given period.
Technical scope
Identifying the relevant devices and media, the pertinent traces, and the limitations of the analysis.
In a digital case, the question is not only which device or medium exists, but what it can actually demonstrate. The analysis begins with assessing the available sources, their context, their condition and their relevance to the question at hand.
Devices and media
A wide range of equipment, but the same requirement for method.
Phones and tablets
Mobile devices, backups, conversations, files, metadata and applications. They can shed light on exchanges, movements, photos, deletions, synchronisations or interactions with online services.
Removable media
USB drives, memory cards, external disks and local backups. They can indicate copies, exports, transfers, file versions or items kept outside the main workstation.
Accounts and messaging
User accounts, messaging services, shared drives, connection records and settings. They can help establish who accessed what, when, from which environment and under which forwarding or sharing rules.
Business applications
Internal software, exports, logs, accessible databases and history. They can link business actions to accounts, dates, decisions, orders, files or disputed changes.
Logs and systems
Logs, servers, network equipment, access records and security events. They can confirm a connection, an error, an intrusion, a data flow or an inconsistency in a chronology.
Technical questions
What the analysis seeks to clarify.
Who could have acted?
Account used, session open, rights available, connection address, device involved and consistency with known usage.
When did the events take place?
Timestamps, logs, metadata, synchronisations, backups and indicators that can be used to build or challenge a chronology.
Which data is involved?
Files, messages, exports, databases, documents, attachments, folders or application-level elements linked to the question at hand.
Was there any copying or transfer?
Removable media, downloads, shares, transmissions, synchronisations, archives, history and access records for remote spaces.
What can be established?
Distinguishing a robust technical finding, a reasonable hypothesis, a limitation of the analysis and a point that requires further evidence.
What are the limitations?
Encryption, absence of logs, deletion, incomplete access, data held by a third party or insufficient human context.
Method
Assess before extracting, explain before concluding.
Take stock
Identify the available sources, the access, the condition of the devices and media, and their relevance to the case.
Preserve
Limit unnecessary handling, document the actions taken and preserve what needs to be preserved.
Analyse
Search for the relevant traces, chronologies, inconsistencies and usable elements.
Report
Present what is established, probable, uncertain or out of scope, in language that can be understood.
Limitations
A digital device or medium never speaks for itself.
Context and caution
A trace must be placed back in its context: timestamp, account used, configuration, access rights, synchronisation, backups and possible human or automated actions.
Usable reporting
The report must help decide or debate: it distinguishes technical findings, hypotheses, limitations of the analysis and points that require further evidence.