Computer forensic analysis

The objects of forensic examination and research of computer equipment and software products may be:

  • Computer equipment;
  • Software products;
  • Hardware and software complexes, etc.

When ordering an examination of computer equipment and software products, the following materials must be provided:

  1. Computer equipment and tangible media (hard drives, etc.).
  2. Appropriate materials that contain information about the process.
  3. Other materials depending on the issues that are put to the expert’s decision.

The main tasks of the examination of computer equipment and software products are:

  • establishing the working condition of computer hardware;
  • establishing circumstances related to the use of computer hardware, information and software;
  • detection of information and software contained on computer media;
  • establishing compliance of software products with certain versions or requirements for its development;

Indicative list of issues to be addressed:

  1. Does this medium contain information regarding (specify what information you are interested in) and in what form?
  2. Does the media of the computer under investigation contain information about certain (specify which) user actions?
  3. Has the drive under investigation been subjected to certain procedures to destroy information?
  4. Could the specified information have been created on this computer or was it transferred from another medium?
  5. How was the information (specify which one) transferred to the computer (media) under investigation?
  6. What is the technology and chronology of creating an electronic document (specify the electronic document and specific content)?
  7. What are the attributes (time of printing, editing, creation, deletion, etc.) of files containing information regarding… (specify content)?
  8. Does the storage device of the computer under investigation contain any specific (specify which one – installed, not installed) software?
  9. What functional malfunctions does this computer equipment or its individual components and devices have, and how do these malfunctions affect the operation of the equipment as a whole?
  10. Is it possible to perform certain actions using this software product?
  11. Is it possible to solve a certain problem using this software product?
  12. Are the functions provided for in the technical specifications for its development implemented in this software product (software code)?