Corporate Investigator Answers Investigation

Computer Investigation (4)
Preserving Evidence

Preserving Evidence is the first priority, therefore there are steps to be taken which may prove vital later on Call us on 020 7158 0332 or send an email to

Something wrong? What to do to preserve evidence on a computer or system


Preserving Evidence is the first priority, therefore there are steps to be taken which may prove vital later on

Something not to be forgotten is that those first on a scene should take steps to ensure the safety of all persons and of course to ensure the integrity of evidence. All activities should adhere to your company's organisational policy and the law. Ideally, of course, a locus will be left alone until qualified personnel are available. If you can, visually identify potential evidence whether physical or electronic and evaluate whether any is fragile

Try not to touch! If at all possible don't move anything; leave equipment on that is switched on and equipment off that is switched off. It is a good idea to take some digital photographs of where equipment lies which can match the photographs we take, demonstrating that equipment has not been altered in any way - possibly important in an evidential process later on. Disconnect telephone lines, but from the wall rather than the machine

Fingerprints may be on peripherals such as the computer mouse or CD's. We have an in-house fingerprinting department that works in conjunction with IT forensics. A scene examination may be appropriate, for example in demonstrating that a particular person has used the machine through lifting of prints from a mouse on-scene. Chemicals used in the processing of prints may damage equipment or date therefore the manner in which equipment is handled is important

Documentation and Chronology - Maintaining a chain of evidence and documenting activity is an ongoing process starting with recording the location and condition of all units, whether subsequently forensically examined or not. Simple issues may have relevance - such as a mouse being on the left hand side rather than right, indicating a left handed user. The condition of the CPU, disturbance of dust and whether it is on or off, or on and warm, are all recorded. We will take locus photographs of the front of the machine, screen, environment and other processes

Forensic evidence may be crucial in investigation of the misuse of company information by an ex-employee, Internal theft or fraud, analysis of email and deleted files, Pornography and illegal downloads, Data Recovery, Paedophilia, Substance Abuse and dealing, misuse of the internet or Theft of Intellectual Property (e.g. databases)

Evidence gained from computer investigation was instrumental in thie Employment Tribunal case reported in the Daily Telegraph

Daily Telegraph Employment Tribunal

Rebuilding deleted evidence from a corporate laptop or terminal is often crucial in fraud and employee investigation

Corporate Investigation

Similarly, a legal investigation of a computer will yield the evidence needed for a contentious litigation or other issue


Rebuilding anything that has ever been input into a computer regardless of deletion

Computer Recovery of deleted files and timeline building

How to preserve evidence that can be analysed and investigated later

computer forensic evidence

Step by Step advice on preserving an evidence scene will produce the best result possible for analysis

Preserving evidence for a Computer Investigation

What immediate action to take if you suspect a machine may have been compromised or may contain evidence

Preserving evidence for a Computer Investigation
Private Investigator

"searching the world for answers"

Copyright © Detective Ltd 1995-2024 ·

Site Map