Seizure planning
We work with your team to establish the basis of an investigation and the scope, breadth and depth of electronically stored information that might be sought during the capture phase.

Typically your team will include HR, legal and IS, each of whom will have input into the framework in which we will all operate and the roles and responsibilities of each of us.

The planning phase will take into consideration any claims and potential defences, preservation requirements, disclosure requirements and discovery demands.

Key decisions in this phase will include the identification of devices from which evidence may be gathered, profiling the technical capability of the subject of the investigation and advising on conduct on target to ensure that potentially volatile evidence is gathered properly.

Seizure support
One of the most critical elements in any investigation is ensuring that you seize all the relevant and necessary evidence to support the case. A critical aspect of this is the proper identification of items that may contain that information.

During a seizure operation we are able to support law enforcement and other organisations by advising on what items are likely to be relevant and thus worthy of collection for preservation and analysis.

In the emerging world of pervasive computing we routinely identify items that may have been overlooked previously in a search and are increasingly advising on the necessity to undertake live forensic capture of data to prevent loss of critical evidential material.