Computer forensic investigation is the examination of desktop computers, laptops, and servers for evidence of activity that is relevant to a legal, disciplinary, or regulatory proceeding. It is one of the most powerful investigative tools available to employers, litigants, and investigators because computers retain evidence of activity that most users do not know is being recorded, that cannot be effectively erased without specialist tools, and that provides an objective, contemporaneous account of what was done and when.
In workplace investigations, computer forensics has changed the evidentiary landscape in misconduct cases. An employee who denies accessing a competitor’s systems, copying data before their departure, or communicating with a third party about confidential information, faces a forensic record that tells a different story in a form that is very difficult to credibly contest.
What Can Computer Forensics Reveal?
The range of evidence that a computer forensic examination can recover from a single device is substantial and typically extends far beyond what the user believes was recorded. The examination can reveal:
- Every file that has been opened, including the date and time of access, even where the user has subsequently deleted the file or emptied the recycle bin.
- Every website visited in any browser on the device, including sites accessed in ‘incognito’ or ‘private browsing’ mode, which are not fully private from a forensic perspective.
- Every email sent or received through the device, including emails that have been deleted from the email client or server, recoverable from the device’s storage.
- Every document printed from the device, identified through print spooler logs and application artefacts that record the output.
- Every external device connected to the computer, including USB drives, external hard disks, and smartphones, identified through the Windows registry and event logs.
- Every file copied to external storage, identified through the device’s connection logs and file system artefacts, where the file was copied after the device was connected.
- User account activity: logon and logoff times, failed login attempts, and account activity that establishes who was using the device and when.
- Application usage: the applications installed on the device, when they were used, and what actions were taken within them, to the extent that the application maintains its own audit log.
Common Investigation Scenarios
Employee misconduct: examination of an employee’s work computer for evidence of misconduct: accessing competitor systems, browsing inappropriate content during work hours, communicating with third parties about confidential information, or taking company data before departure.
IP theft and data exfiltration: establishing what data was accessed on a computer, whether it was copied to external storage or transmitted externally, and when this activity occurred.
Commercial litigation: recovering evidence from computers used in the course of a commercial relationship, including documents, communications, and records of financial transactions.
Fraud investigation: identifying the digital trail of fraudulent activity: the creation of false documents, the manipulation of financial records, the communications that evidence the fraudulent scheme.
Policy breach: establishing whether an employee has accessed systems, websites, or content that breaches their employment terms, acceptable use policy, or regulatory obligations.
Evidence Acquisition
Evidence acquisition in computer forensics follows the standard forensic methodology: a bit-for-bit forensic image of the device’s storage is created before any analysis is conducted, the image is cryptographically hashed to establish its integrity, and all subsequent analysis is conducted on the forensic copy. The original device is preserved, untouched, as the primary evidence.
In employment investigation contexts, the device must be taken out of the employee’s possession and secured before the imaging process begins. Where the employee is still in post, this requires a carefully managed process that prevents the employee from accessing or altering the device before the forensic image is taken. Where the device has already been returned after an employee’s departure, the imaging process begins immediately on receipt.
Where the device has been wiped or factory-reset, forensic imaging can still recover significant amounts of data from unallocated space, residual file fragments, and operating system artefacts. A wiped device is not necessarily an evidentially empty one.
Analysis Process
The analysis of a forensic computer image covers the full range of evidence sources on the device. The specific analytical focus depends on the nature of the investigation: an IP theft investigation focuses on file access and transfer activity; a misconduct investigation may focus on communications and browsing history; a fraud investigation may focus on financial documents and communication records.
The analysis uses specialist forensic software platforms that catalogue all accessible data, reconstruct deleted files from unallocated space, parse application artefacts, and produce timeline analysis that places specific events in chronological context. The resulting evidential picture is a detailed, documented account of the device’s activity history.
Reporting Findings
The computer forensic report sets out the investigation’s scope, the evidence preserved and examined, the methodology used, and the findings of the analysis. It distinguishes between factual findings — what the forensic evidence establishes — and interpretive conclusions — what those findings indicate about the events under investigation. It is written in language that is accessible to a non-technical audience and is accompanied by the forensic investigator’s expert witness statement.
The report must be produced to a standard that satisfies the requirements for expert evidence in civil and criminal proceedings, and the forensic investigator must be willing to give oral evidence at any hearing or tribunal where the findings are contested.
Need a computer forensic examination for an employment or legal matter? Contact iSpy Detectives for expert computer forensic investigation services. Our private detectives have recently conducted cyber investigations for business clients in London, Lincoln, Dundee, Leicester, and Swansea.