Examining a computer to discover exactly what data is stored on it, is a time consuming and painstaking process. It is important that the examination can be proved to have been performed thoroughly and in accordance with accepted ‘best practice’ procedures. Failure to do so could render any evidence of computer fraud or abuse unusable in subsequent proceedings.

The first principle of computer examination is to ensure that the original (also referred to as the ‘target’) computer is not altered by any of the examination processes. Additionally, it is necessary to treat target computers with great caution. They could contain viruses or logic bombs (booby traps) which alter the data contained on the hard disk.

Accessing the data on a computer
Vogon’s investigators ensure that the target computer is not altered in any way by booting (starting up) the computer safely, using proven methods. This ensures that if there are any viruses or logic bombs on the target computer, they will not be activated when the computer is turned on.

Types of data on a computer
Vogon’s highly sophisticated tools allow the investigators to thoroughly investigate all the data held on the target computer. In addition to the normal files on the computer we can find the following different types of data:

Extra information to be found on a computer
In addition to the different file types to be found, Vogon’s investigators can discover the dates and times that the target computer records when a file is created, modified, read and deleted. In many instances, computer examinations can also determine the author of a particular document or file or which user created a specific directory.

How Vogon can help
Vogon offers both laboratory and on-site services to secure computer evidence. Additional information about the securing of computer evidence is available as follows: The range of expertise offered by Vogon, techniques used to secure computer evidence, and the risks and pitfalls that must be avoided.