PC and laptop forensic images
DFR can review supplied forensic disk images of PCs and laptops alongside relevant examiner reports and the agreed instructions. A forensic disk image is a representation of storage media for examination; it is different from a digital photograph or screenshot.
Computer artefacts and storage media
An instruction may concern files and folders, available application records, browser artefacts or data held on external storage. The examination is directed by the question in dispute, the format of the supplied material and the records available.
Digital photographs and video
Examination of available digital image and video files can consider their source, metadata and the particular concern raised. The scope may include comparison with supplied exhibits or other available records. Findings depend on the quality and completeness of the material.
Documents, communications and metadata
DFR can assess relevant digital documents, communications and associated metadata within the agreed scope. Questions may concern provenance, context or consistency between an exhibit and accessible source material.
Existing evidence and independent reporting
Provide a brief description of the evidence, any existing forensic report and the question to be addressed. DFR will discuss the required files, appropriate transfer arrangements and the proposed report before examination begins. Mobile acquisition remains available as a separately scoped service.