Data Recovery Case Study
- Details
- Category: Case studies - Services
A very large managed service company had lost a vital database which controlled all their customer records. A technician had downloaded a piece of code to help him with his work, but which deleted the database instead. This code then migrated to the backup server and deleted the backup as well.
We worked with our in-house developers to create a virtual environment on which the database could be reconstructed once we had identified the data mass. Not one record was lost and the client was delighted. Four of our analysts worked 60 straight hours to recover and restore the data for our client.
Email us here for advice and a quotation or please call us on 0044 (0)845 125 4400
Document Forensics-Case Study
- Details
- Category: Case studies - Services
A very large case involving several parties, revolved around some computer-generated documents. We were asked to have a look at these documents to ascertain if we could identify who had created them and if they had been modified.
Using specialist tools and our skills and knowledge of documents we were able to determine the provenance and history of the documents' creators and modifiers along with all the changes and dates from the hidden metadata.
The client obtained evidence that they would not have had otherwise and were delighted with the result.
Email us here or call on 0044 (0)845 125 4400
Forensic Services Case Study 2
- Details
- Category: Case studies - Services
The worst possible thing you can do when confronted by suspicious computer activity is “have a quick look” on the hard drive. You might immediately find what seems like compelling evidence of a crime. But the chances are you have already seriously damaged any hope you had of proving who the culprit was.
Just switching on the machine can alter hundreds of settings which might have been vital to the data detective’s evidence trail. A large manufacturing company suspected widespread intellectual property theft after the managing director and a fellow director left for a rival firm – taking many members of staff with them.
Unfortunately, the firm’s IT manager, suspecting something was amiss, had decided to “have a look” at the director’s laptop. Then they reformatted the drive on the managing director’s machine and gave it to another employee.
Two months later, when it was apparent that the two laptops had been used to plan the defections, the company decided they needed expert help – from us. We discovered that the IT manager’s “quick look” actually meant opening various Microsoft Office documents, altering the ‘last accessed dates’ – a crucial piece of evidence in any inquiry. He also downloaded data recovery software and installed it – overwriting more vital evidence.
Luckily, our experts saved the day. We pieced together fragments of data which proved that confidential files had been burned to CD and, by using our LoPe software, we managed to recover large amounts of email traffic - with attached company documents - and proved they had been sent to the managing director’s home email account.
The company was delighted with our efforts, but they learned the hard way that it pays not to meddle. So remember, at the first sign of an ‘incident’, call Evidence Talks first on 0044 (0)845 125 4400 . Our telephone advice is free.
Forensic Service Case Study
- Details
- Category: Case studies - Services
The technical support department of a large metropolitan council were asked to view a laptop that showed inappropriate image names.
Before calling in experts to view the PC the internal audit team decided to browse through the suspects' PC then copy image files onto their own systems and then follow the suspicious URLs to see if they were "live".
This resulted in contaminating internal audit machines with inappropriate material as well.
Once the evidence was in our possession, dispite the difficulties casued by the Council accessing the live systems and contaminating the evidence, we were able to prove that the suspect had downloaded this material onto his work laptop, even though he claimed it had arrived there from his home machine when he synched the two systems.
He was disciplined and dismissed.
