This service addresses those conducting proceedings: investigators, courts, advocates and notaries. What distinguishes it from non-procedural examinations is not the method but the manner of instruction, the requirements applying to the expert and the form of the document.
The examination is performed upon a decision or ruling appointing it, or upon the instruction of a party to the proceedings. The expert is cautioned as to liability for giving a knowingly false opinion, answers the questions put within the limits of their competence and may not go beyond them of their own motion.
The objects of examination are computer media and equipment, software, data and traces of activity, together with the circumstances established on their basis. Questions of legal characterisation fall outside the competence of the expert.
To obtain a preliminary estimate of scope, timing and fees, please complete the questionnaire. A response is provided within several business days.
Who instructs the examination
|
Investigative authorities and courts
|
Advocates and representatives
|
Notaries
|
|
The examination is appointed by decision or ruling. The questions are framed by the appointing authority; where they are incomplete or technically imprecise, the expert may say so and propose a refinement. |
An examination is performed at the instruction of a party in order to obtain a specialist opinion or to support an application for the appointment of an examination with properly framed questions. |
Securing evidence, including the recording of online content and of the state of hardware and software before a dispute arises. |
Questions put to examination
The list below is indicative; the actual questions are settled by the authority appointing the examination.
- the composition, purpose and functional capabilities of the software submitted
- the presence and content of data on the media submitted, including deleted and damaged data where their recovery is technically feasible
- the circumstances in which actions were performed within an information system: timing, user accounts, sequence of operations and indications of records having been altered
- indications of unauthorised access to, alteration or destruction of information, and the traces thereof
- the correspondence of software to the documentation submitted, to the technical specification or to the characteristics represented
- the authorship of program code, indications of borrowing and the degree of similarity between the objects compared
- the effort required to create the software and the amount of cost necessary to create or replace it
- the operability of hardware and software and any circumstances preventing its use for its intended purpose
- the correspondence of the work actually performed to the terms of the contract and to the reporting documentation submitted
The question of effort and cost of creating software is singled out deliberately: it arises in proceedings concerning the expenditure of funds, the causing of loss and the non-performance of obligations, and answering it calls for technical competence and command of costing methods alike. The same methodology is applied outside the procedural setting: Software cost and IT value →.
Investigation of incidents
Instructions concerning an incident — unauthorised access, loss or corruption of data, or theft of funds by means of information systems — are handled under this service, since such circumstances commonly become the subject of proceedings in due course.
The preservation of traces is of first importance. Steps taken by an organisation’s staff to restore service as quickly as possible frequently destroy the very information needed to establish what occurred: reinstallation of systems, clearing of logs, reuse of media. On discovering an incident it is advisable to secure the media and logs until the further course of action has been settled.
The examination covers the creation of bit-for-bit copies of media with recording of hash values, reconstruction of the sequence of events from the logs of systems, security tools and network equipment, identification of the point of initial entry and the sequence of actions, and determination of the volume of data affected.
Handling of objects of examination
|
1
|
Receipt of objects
Objects are received under a record describing them, their identifying features and the condition of their packaging. Any breach of the packaging is recorded before examination begins. |
|
2
|
Creation of copies
The examination is performed on bit-for-bit copies. Hash values of the original and the copy are recorded and stated in the report, allowing the immutability of the original object to be confirmed. |
|
3
|
Examination
The methods applied, the software and hardware tools employed and the sequence of actions are described in the report in sufficient detail for another specialist to reproduce them. |
|
4
|
Report
The report states the particulars and qualifications of the expert, the basis on which the examination was performed, the questions put, a description of the objects, the course and results of the examination, and the conclusions on each question. Conclusions are expressed in categorical or qualified form; where a question cannot be answered, the reason is stated. |
|
5
|
Return of objects and clarification
Objects are returned under a record. Upon summons, the expert attends to clarify the report given. |
Requirements applying to the expert
The examination is performed by a person holding the corresponding qualification of non-state forensic expert. Particulars of education, speciality and experience are stated in the report and may be verified.
The expert may not give an opinion on questions falling outside their specialist knowledge, nor on questions of a legal character, including whether an offence has been committed and whether any person is culpable.
Where circumstances exist that preclude participation in the proceedings, including any official or other dependence upon the parties, the examination must be declined. Such circumstances are verified before materials are accepted.
Timescales
The time required follows from the volume of objects submitted and the questions put. The examination of a single item of media ordinarily takes two to four weeks; complex examinations involving numerous objects may take several months. The period is agreed when the materials are accepted.
Frequently asked questions
Must original media be handed over
As a rule, yes: the examination is performed on bit-for-bit copies, but making a copy requires access to the original. Receipt, custody and return are documented by record. In certain cases copies made under an established procedure will suffice.
May the practice be instructed before proceedings have commenced
Yes. A specialist opinion is then prepared, or an examination by way of securing evidence. The form of document follows from the purpose for which it is to be used.
What should be done on discovering an incident
Secure the media and logs, restrict access to the systems affected, and refrain from reinstalling systems or clearing logs. Restoration of service is best carried out on standby equipment, preserving the original state.
May the expert decline to give an opinion
Yes, where the questions put fall outside their specialist knowledge, where the objects submitted are insufficient and cannot be supplemented, and where circumstances precluding participation in the proceedings exist. A declination is issued as a reasoned communication.
Does the expert attend the hearing
Yes, upon summons by the court, in order to clarify the report given and answer questions from the participants.