Digital Evidence Recovery

In some cases, evidence needed or required for criminal investigation is stored on the hard disc duly distributed and marked, with characteristic names and extensions on appropriate locations.

However, there are cases when forensic experts are not so lucky. Cyber-crime perpetrators or perpetrators may sense that they are to be arrested soon and therefore delete incriminating evidence. Sometimes, a perpetrator may use sophisticated techniques to hide data. In some cases, the data that might be important evidence, has never been stored on the hard disc, but was used exclusively from transferable media:

  • mass use of mobile devices that contain private and company data
  • use of mobile devices for online transactions
  • evidence for purpose of police and prosecution investigations
  • location history of subject
  • private detective investigations