Methodology

Computer Forensics Methodology

The computer forensics process can be broken into four general phases.

Identify

Identify

Should you look at a single computer or an entire network? Laptops? Servers? Cell phones and tablets? USB Storage Devices? Knowing where to look can make all the difference. The first step in a case involving electronic evidence is to determine where the information is stored.

Collect

Collect

Once the location of the information has been determined, it must be collected in a way that preserves the integrity of the evidence. Special computer forensic hardware and software are used to ensure that the original data is never altered and that the evidence collected will stand-up to legal scrutiny. Once the data is collected, it is verified and backed up so that you are sure to have a current “snapshot” of the data.

Analyze

Analyze

The greatest challenge when dealing with electronic evidence can be sifting through the mountains of data to zero-in on the information that is most relevant to your case. Based on the particulars of each case, a unique search strategy is developed to find the right data in the most cost and time-effective way possible.

Report

Report

Helios has developed its own reporting techniques that help get analysis information back to you in a meaningful and timely manner. These reports allow you to see what evidence has been collected and then refine and focus the search resulting in better quality results. Once the investigation is complete, a professional expert report can be provided documenting the investigation and any resulting opinions.