Digital investigation and forensics.

Example need. A law firm needs to understand when a file was accessed or modified. Within the authorised scope, copies of media, system and firewall logs, metadata and available backups are compared.

Forensic acquisition, log analysis and deleted-data recovery tools examine retained traces. Clock differences and periods without data are reported. The report separates established elements, hypotheses and matters that cannot be concluded. A network address or location trace alone does not identify a person.

Firewall logs can be analysed alongside those of endpoints, servers and applications. Allowed or blocked connections, network addresses, times and security events are compared according to the information retained.

The aim is to understand observed exchanges and their sequence. Clock differences, missing periods and log limitations are taken into account.

Accessible files, messages, histories and usage traces are examined. Several sources can be compared to check an event or recover information in context.

Deleted data can be searched for on media and in available copies or backups. Recovery possibilities depend particularly on the medium, its condition, encryption and subsequent overwriting.

Recovered items are distinguished from incomplete fragments and information that could not be found.

Location data in accessible files, photographs, applications or histories can be examined. Its origin, date and precision are checked before comparison with other events.

A location clue must be interpreted in context. It does not, on its own, establish a person’s presence at a location.

Observed facts, hypotheses and unresolved questions are separated. Sources and analytical limitations are described so that conclusions can be understood and checked.

The research objective, authorisations, available devices and confidentiality conditions are established before intervention. Source preservation is considered from the preparation stage.

Describe your situation FR