COMPUTER FORENSICS
Sensible data and information defined as “business critical”, such as corporate email messages, contracts, databases, websites, and new projects, can be targeted by not authorized subjects causing serious risks for the company concerned.
According to several sector studies, industrial espionage has substantially increased over the last few years to such an extent that in 2015 4 out of 10 companies have reported data loss or privacy violations after thefts and/or attacks from the net.
Computer forensics aims at containing and preventing data theft, industrial espionage, unauthorized access to corporate computer systems, and computer damages, as well as clarifying those behaviors and facts which involve the use of computer systems, with the support that a company needs.
The ongoing evolution and complexity of computer systems, as well as the digitalization of many activities, forces layers to continuously seek help from specialized technical consultants in order to extract, analyze, and show digital data before the court, using scientific techniques which can legally refute every doubt regarding the validity of the result obtained.
In Italy, the reference law which indicates how to legally use the results of forensic analysis before the court is the law number 48 dated 2008, also known as “law of ratification of the Budapest Convention”.
We use different approaches for the analysis of computer systems to identify a possible offense, according to the functioning state of the systems themselves and scope for application of the analysis.
-
A posteriori analysis: this is an analysis which is performed with the machine off, after an offense has been committed. It is the most common activity and normally consists in the seizure of the hard disk (or in general a storing device) which is then analyzed in a specialized laboratory.
-
Live analysis: the method uses analytical techniques when the systems are switched on. This approach is based on the fact that some type of offence, such as the unauthorized access to computer systems, requires the extraction of traces which are present not in the hard disk but in the RAM, which is volatile storing device that can keep information as long as the system is powered. Furthermore, many storing devices can be protected by coding, while RAM analysis can be very useful when it comes to extract system access credentials.
-
Forensic disk: the creation of forensic copies (bit to bit) on which a series of analysis can be performed in relation to the results desired.
-
Forensic memory: to retrieve information from RAM, which is a very high volatile storing device. The forensic analysis of RAM is particularly indicated to retrieve passwords from the system and information related to running processes, as well as the analysis of SWAP Space if performed in concomitance with the analysis of forensic disk.
-
Network forensics: the analysis of network operating systems, in order to underline any legal evidence for a specific case.
-
Internet forensics: it uses the techniques and methodologies of the other types of computer forensics, such as websites, e-commerce sites, or social network.
Contact us
+39.02.8252342
MIlano
Centro Direzionale Milanofiori
Strada 4, Palazzo A5
20057 ASSAGO (MI)
Roma
P.le Roberto Ardigò, 30/a
00142 Roma
Tel. +39 06 45442737
Ask for a quote
Fill in the form below by asking us a question or describing your need!
One of our experts will contact you without obligation to provide the requested information!
