Computer Imaging

There will be occasions when suspected criminal activity has the potential to cause sufficient dislocation or loss to warrant the covert retrieval of data from a computer's hard drive.

However, it should be stressed that Computer Imaging must always demonstrate just cause. Otherwise it will not be in compliance with the Data Protection Act 1998 and may not be admissible as evidence in a tribunal setting.

So provided there is a legal reason to do so, an IT expert can retrieve a real-time image of all the files on any hard drive while a computer is in use.

Sometimes referred to as ‘computer ghosting’, this investigation tool will not retrieve data that has been deleted from the recycle bin folder. To gain access to this information, more sophisticated Hard Drive Interrogation techniques must be employed.

Hard Drive Interrogation

Whether a hard drive has been inadvertently wiped or whether it has been intentionally erased to cover a fraudster's tracks, lost or deleted information can be recovered by IT investigators.

Although deleted files may not be visible, they continue to quietly reside on a machine's hard drive until they are over-written and become so fragmented as to be almost indecipherable.

However, all is not lost. In most cases, an IT expert can not only retrieve deleted files but can also retrieve pieces of related files that are parked in different areas of a computer's hard drive.

Even fraudsters intentionally reformatting a hard drive and installing new images to cover their tracks are not protected. By ‘interrogating’ the computer's hard drive - even when it has been over-written - IT experts can piece together sufficient evidence for investigation purposes.

Should you wish to know more about our Data Management and IT services, an initial consultation implies no commitment to proceed and our discretion is assured.