Computer Forensics Methodology-

Each case is unique and the dynamics of each case should be taken into account during the “initial consultation with client” .

Thereafter, “legal authorization” should be established and a “written agreement”, outlining the merits and instructions, should be entered into. The “Bag & Tab” procedure will follow (in South African law this process will be dealt with differently during a criminal or civil investigation) ensuring a proper “Chain of Custody” is followed.

Ensure that the “Integrity and Authenticity of Data” is upheld in a court of law by using a “Write Blocker” when making a “Bit-for-bit” image (a.k.a., a mirror image) of the electronic device. “Data Analysis” on the mirror image can proceed, during which consultation with client should be maintained.

Registry and RAM analysis should be part of your investigation methodology as these investigative methods do not form part of your “normal” disk analysis or data mining. During your initial consultation it will be established whether a “dead” or “live” analysis should be performed. One of the most important steps during the process is “documentation, documentation, documentation”. This will ensure that should you have to testify in court you have record of the procedures and steps you followed during your investigation.

Ensuring sound computer forensic investigative methodology was followed will guarantee a "Sound Forensic Report is delivered to clients or legal authorities.

We offer computer forensics services, as well as forensics reports and when needed, expert witness services. Mobile cellphone investigation, computer data forensics and other digital forensics investigative work is untertaken with updated, certified, tried and tested forensics tools and software. Also proof of mobile/cell identity ownership and to identify IMEI number ownership.