Computer forensics

Due to the increasing use of electronic information in nearly every business, conducting a computer forensic investigation and responding to litigation requires the careful collection of electronic evidence through the use of technology not readily accessible by ordinary computer users.

At BDO Kendalls we work with you to secure and collect electronic information, analyse the results and present a comprehensive understanding of transactions, communications or indications of tampering.  We arm you with the facts and analyses to address litigation needs and to respond to allegations thoroughly and appropriately.

Our team has helped a range of organisations, including law firms, companies in most industries and government agencies.  Our experience includes engagements that have varied in size from a few employees' hard drives, to matters involving securing and analysing networks and hundreds of pieces of individual media, including hard drives, external drives and handheld devices.

How can we help you?

We draw upon our experience with computer forensic technology to help identify potentially available electronic information, determine the locations where information is likely to be stored and advise on the process for the efficient and effective retrieval, analysis and presentation of the information. Our team assists organisations facing significant litigation, allegations of fraud or irregular activities, or the need to investigate potential employee misconduct.

Our team are comprised of a multi-disciplinary team of IT professionals, forensic specialists, fraud examiners and Chartered Accountants who provide you with a thorough, well-rounded investigative approach.

Service details

A detailed description of our computer forensic services is provided below.

Data imaging and analysis
We can discreetly access and image computers, networks and other storage media, as well as perform in-depth analyses in our secure lab. We maintain chain of custody forms and document our procedures indicating when data has been appropriately accounted for and preserved.

• Collecting and preserving electronic evidence
• Analysing an individual's conduct, including deletion activity, internet browsing activity and wiping / secure deletion activity;
• Searching live and deleted files, unallocated space and slack space, based on keywords and/or concepts and
• Expediting document review by assisting in preparing a document review environment, analysing content in its native format, removing known system files and other known user files to limit keyword search results and de-duplicating documents.

Corporate investigation support
As support for an existing internal investigation, we can, with minimal disruption, independently examine a subset of hard-drives and/or other storage media to identify 'deleted' files and emails not previously identified.