Collecting Digital Evidence

Collection of evidence in the form of digital data is performed in order to conduct a legally relevant and forensically proper removal of digital media, as well as copying this data for further investigation. This service is necessary for analyzing the information security incident, with subsequent possibility of initiating and investigating a criminal case.

Group-IB’s specialists perform the following range of services for proper digital evidence collecting:

  • Preliminary consultation;
  • Prompt visit of the incident scene by a specialist;
  • Gathering information regarding the incident and identification of storage sources for evidentiary data related to the incident;
  • Collecting the available evidence in the form of digital data, preserving and documenting it in accordance with the requirements of Russian legislation;
  • Performing the necessary paperwork;
  • Consulting authorized representatives regarding the necessary measures for incident counteraction and damage reduction.

In order to ensure the data’s legal relevance, Group-IB’s experts perform its collection in compliance with all requirements of Russian legislation, employing nondestructive copying methods. The collected data and the original media are sealed in such a way as to preclude access to the information without compromising the integrity of the packaging, with the seals of the client organization and Group-IB affixed on it, in addition to the signatures of other persons involved in the process. Moreover, all actions regarding data collection are recorded in the applicable report signed by all involved parties.

Collecting Digital Evidence

When collecting digital evidence, the forensic specialist identifies digital data media related to the incident, seizes it, and subsequently copies the data.

After all work is completed, the client is presented with the following:

  • Sealed digital data media, which can be used as evidence in a criminal case;
  • Copied forensically relevant data, which can be used to conduct an internal investigation of the information security incident;
  • A set of documents confirming seizure of digital data media and its copying.

After the collection of digital evidence, the client can forward the sealed digital data media and its copies to Group-IB’s forensics and data recovery lab for further forensic investigation. This service ensures a detailed analysis of the incident, and is an essential part of the investigation.

Collecting Digital Evidence

The proper collection of digital evidence in accordance with applicable legal requirements is a necessary step in the course of investigating information security incidents.

As a result of the digital evidence collection services provided by our experts, you will receive the following:

  • Properly executed documentation. The media and data collected during investigation are documented in accordance with applicable legal requirements, ensuring that the resulting evidentiary base will be considered and admitted by law enforcement and judicial authorities.
  • Full scope of information regarding the incident. Data copying is performed on all sources of forensically relevant information, allowing restoration of the circumstances of the incident regardless of attempts by criminals to conceal the traces of their actions.
  • Independence and reliability of the resulting data. A reliable result achieved during the course of digital evidence collection is ensured by the comprehensiveness and accuracy of determining the circumstances of the incident. The involved independent experts will ensure the reliability of data even in cases involving internal employees.
  • Ability to conduct a forensic investigation. The computer forensics and data recovery lab operates as part of Group-IB, and the collected data can be sent there for a comprehensive independent examination. This step ensures detailed information regarding the incident. The expert determination is accepted by law enforcement agencies and courts as admissible evidence for civil, administrative, and criminal proceedings.

Contact Us:

+1 917 809-47-41

More information