Computer and storage media analysis

What the analysis covers

The examination focuses on data relevant to the assignment. Interpretation considers the operating system, applications and information storage mechanisms.

• Files, documents and available system data.
• Metadata, activity traces and event timelines.
• Data consistency and available indications of modification.
• Hard drives, USB drives and other supplied storage media.

Forensic copies and data integrity

Depending on the material, work may include creating a forensic copy and analysing it rather than the source medium. Hashes verify integrity since capture; they do not, by themselves, prove content accuracy, authorship or completeness.

Interpreting traces and metadata

Timestamps and activity traces are assessed alongside other information. System settings, time zones, file copying and usage history can affect their interpretation.

Scope of the opinion and technical limitations

The report identifies source material, methods, supporting evidence and answers to technical questions. It also addresses missing data, media condition and other limits on the conclusions that can be drawn.

Information needed to assess the assignment

Specify the computer or storage type, its condition, available material and purpose of analysis. Include details of existing copies and any earlier actions on the device.