FAQ

Our forensic procedure follows a strict 5-step protocol:

1. Reception and documentation — recording of the media with photos, serial number, physical condition observed. Issuance of a signed acknowledgment of receipt.
2. Forensic acquisition — bit-by-bit cloning of the original media via a certified hardware write-blocker. Calculation of MD5 and SHA-256 hashes on the acquired image. The original media is never modified.
3. Analysis — investigation on the working copy: recovery of deleted files, analysis of metadata, reconstruction of the activity timeline, identification of artifacts (logs, history, registry).
4. Documentation — each action is recorded in a time-stamped log. Relevant files are extracted and cataloged.
5. Expert report — detailed report including the methodology, tools used, results and conclusions, accompanied by digital attachments.

#forensic procedure #acquisition #write-blocker #expert report #protocol