The image is an exact replica of the suspect computer hard drive or other media. It can be investigated instead of the original computer. Investigators can explore all areas of data to look for evidence or clues without changing or compromising the original data. For example, to view the last accessed Internet site, to read saved email files or to navigate around the image as though it were part of the original computer.

The taking of an image is a vital step in a computer forensic investigation. It is accepted as the best method for capturing computer evidence that may be presented in a Court of Law.

Vogon offers both laboratory and on-site services to secure computer evidence. Additional information about the securing of computer evidence is available as follows: The range of expertise offered by Vogon, techniques used to secure computer evidence, and the risks and pitfalls that must be avoided.

For immediate assistance please visit our emergency page for a list of contact phone numbers and enquiry form. To discuss your future Computer Forensic or Computer Security requirements with one our experienced investigators please contact us by letter, phone or email.

Processing the evidence
Having captured the data from the suspect machine in a fashion that enables any information found to be used as evidence, the next step is to process the image. With the vast experience that Vogon has gained from our data recovery and data conversion expertise, virtually all file systems can be processed. An image can be processed in a variety of ways to suit the needs of the case and the customer. In some instances a file extraction may be appropriate, in others a data index may be created for our powerful search tools to be run against.

Computer Investigation – Searching the data
Looking for one or two words or an account number across gigabytes of data, is a bit like looking for a needle in a haystack. Experienced Computer Investigators work with highly sophisticated tools, many of which are not available for general release. These tools will quickly identify the required information in mere seconds. Word searching and text recognition technology combined with the experience of an investigator soon close down the hunt.

With the right tools, an entire computer network can be searched for specific words or characters. This search will reveal every occurrence of these words or characters, even if the data was deleted by the criminal to cover his tracks.