Capturing and preserving data to proper evidential standards is a fundamental process that must be undertaken properly to ensure that there is no risk that evidence is not admissible.

Data capture

We capture and preserve evidence in accordance with the ACPO Good Practice Guide for Computer-Based Electronic Evidence that lays down four basic principles for the proper handling of computer based evidence:

• Principle 1
  No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court.
• Principle 2
  In circumstances where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
• Principle 3
  An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
• Principle 4
  The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.

Data analysis
The data capture and preservation phase of an investigation is likely to have generated a substantial amount of digital data that must be investigated and analysed. Doing so efficiently and thoroughly is one of our key objectives.

We routinely use a range of tools from industry standard forensic packages such as EnCase (c) and FTK (c) to our own highly tuned data analytics software to highlight the most relevant items of data.

Data analytics will encompass all forms of storage type including documents, email, free text, spreadsheets, audio, video and still images and may even necessitate the recovery of data hidden through the use of steganography or encryption.

We find one of the most powerful forms of analytics is to show the inter-relationships between what may appear at first sight to be disparate items of data, but when linked show the digital equivalent of social networks.