Computer Forensics* is the process consisting of identifying, capturing, safeguarding, analysing, extracting & presenting evidence that has been generated electronically & saved in electronic media with the objective that it be accepted in a legal process.

Our Computer Forensics services oriented to Litigation Support offer an integrated backbone in the preparation, flow and decision making in the judicial process linked with the Electronic Evidence.

The methodology and technology by Cybex® goes as follows:

1. Electronic Evidence Consultancy: Once it has been established that the capture of Electronic Evidence is necessary, Cybex´s consultants advise companies on the best way to obtain and safeguard the available Electronic Evidence, as well as the time and costs related to this operation. By contacting Cybex´s consultancy services in advance, their analysts can detect the available opportunities and advantages before beginning any kind of procedure. Additionally, they can also maximize the chance of obtaining relevant documents during the first analysis and to guarantee the admissibility of the evidence found. The consultancy stage will result in an action plan for defining which devices should be captured to construct the data universe*, as well as which criteria should be set up for filtering and analysis.

2. Identifying the implicated storage media devices in the investigation: The identification process includes analysing where and how the evidence was created and stored and which operational systems are resident. This information will allow the analyst to select the best method for data recovery and the best tools that should be used to safely capture the media involved. The correct identification of the implicated media storage device in the investigation can dramatically reduce the costs of obtaining and subsequent forensic analysis of the evidence.

3. Beginning the chain of custody * With the objective of guaranteeing the integrity of the data in the original media storage during the whole of the investigation & to safeguard the method of admissibility of evidence, the Cybex engineers apply rigorous legal processes & the necessary technology to create a firm chain of custody, once the judicial process has begun.

4. Capture of the original storage media During the process of capture, the acquisition team are responsible for making an exact copy bit by bit of the original storage media before a notary (forensic copies*) that, supposedly, contains the desired digital media that is going to be analyzed securing the chain of custody*, for both the original and further copies. From this point onwards the researcher will only work on the forensic image, placing the original in the possession of the notary. By means of proprietary tools*, Cybex engineers possess the necessary skills and experience to capture forensic images of the majority of operating systems and storage media. Depending on the complexity of the case, the process of acquiring the forensic images can be done locally or remotely. Furthermore, these procedures are no longer only applied to computers. Electronic organisers, mobile phones, digital cameras or GPS systems all form a part of the group of electronic media susceptible to be analyzed by forensic experts.

5. Transfer of forensic copies* to the laboratory Once the forensic copies or images have been captured, they are downloaded onto the information systems at our Forensic Information Laboratory. Once downloaded and the integrity verified, the data is analyzed to search and extract the evidence.

6. Recovery of deleted and operational systems data* Due to the fact that the architecture of operational systems now gives priority to output over security, a forensic expert can recover files and fragments that were previously erased or modified by the user. Moreover, the majority of today’s operational systems produce a great deal of information related to the tasks made by the user of the PC without their awareness. However this information can be recovered by a forensic expert provided with the right tools and, as a result, can be utilized as proof during a court procedure. Additionally, the exponential growth of the size of storage units allows forensic experts to recover data that has been erased or manipulated months before.

7. Filtration and analysis of relevant documents: Cybex´s experts in Computer Forensics implement the latest technologies in document-retrieval to filter and analyse relevant information. Eliminating irrelevant documents; filtering duplicates; document indexing; contextual determination; semantic search or temporary sorting are some examples that permit location of the searched information in a quick and safe way.

8. Identification and extraction of evidence: The overall results obtained during the recovery process of the deleted files and environmental data*, plus the subsequent filtration and analysis of these, identifies all the significant information that can add value to the investigation, constitutes Electronic Evidence and incorporates it into the strategy of the legal case.

9.Reconstructing the chain of events: In some investigations it is not only important to recover some files, but also to reconstruct the historical chain of events related with them. Data such as the creation date, erasure, printing or sending by means of an email, disk or CD-ROM can be critical during a legal procedure or out of court agreement.

10. Presentation of results, preparation of the final report and ratification in court: From the beginning of any investigation, Cybex´s engineers are conscious of the future declaration and presentation of the final report in court. The clarity and simplicity that is required to present the obtained results means Cybex allocates a team specialized in declaration. Their knowledge about the evolution of the doctrine in respect to the admissibility of the Electronic Evidence coupled with their experience and training in testifying and defending the content of their expert reports before Tribunals, allows Cybex to add unique value for their clients.