All digital evidence is identified in our forensic laboratory, which adheres to international standards. Our forensic engineers, who have years of experience in their field, perform these identifications in a reliable and auditable manner, and the results are reported in compliance with the legal system.
GENERAL PROCESS OF DIGITAL FORENSICS SERVICES
The forensic process at the Forensic Defence Forensic Laboratory begins with the identification of the digital material related to the crime. An image (backup) of the identified digital material is taken using write-protection methods to prevent any tampering. A technical examination related to the criminal incidents is conducted on the image using forensic software. During these procedures, historical data can also be scanned using data recovery software on the image. In the final stage, an expert opinion is prepared following the Civil Procedure Code and the Criminal Procedure Code regarding computer and hard disk examinations as part of the Forensic Defence Forensic Service.
HARD DISK EXAMINATION
Hard disks are mechanical devices that provide permanent and rapid data storage. Data written on the hard disk is physically recorded, so it is not erased when the power is off or the disk is stopped.
Every piece of data you record on a hard disk is stored on magnetic layers on the disk. This is achieved using magnetization principles. Each piece of data recorded is written on magnetic media, ensuring data is saved. The magnetic layers on the hard disk have circular tracks on the top, known as tracks. The layered structure of the hard disk is illustrated below.
At the Forensic Defence Forensic Laboratory, hard disk examinations follow the sequence outlined below;
- Image Acquisition and Verification:
The hard disk under examination is first imaged using physical devices (Tableu TD1, TD2, etc.) or software (FTK Imager, Linux DD) with write protection activated. After the imaging is completed, the hash values provided by the device or software are verified, concluding the imaging process.
- Planning and Software Selection Based on Case Subject: After the hard disk image related to the criminal activity (credit card fraud, data leakage, etc.) is identified, it is analyzed using advanced forensic software such as Encase, MagnetAxiom, and FTK.
- Scanning Existing and Deleted Data on the Hard Disk Surface:the examination involves deleted data, data recovery is performed on the hard disk image first, followed by an examination of the recovered data.
- Examining the Scanned Data:
After scanning the data with forensic software, the raw data can be examined using different software. For example, if email files (pst, eml) are extracted using forensic software, they can be more easily and thoroughly examined with software like Kernel Outlook PST Viewer.
- Report Preparation: The examined hard disks are reported in compliance with the Criminal Procedure Code and Article 293 of the Civil Procedure Code (HMK) for use in judicial and administrative units. These reports, prepared by Forensic Defence experts, are valid in Turkish judicial and administrative authorities and even under international legal norms.
In Summary;
Digital evidence has become the most important evidence used by judicial authorities (Courts-Prosecutors-Lawyers) and administrative authorities (Inspection Boards-Internal Audit Units-Legal Consultancies) to clarify incidents. In this context, hard disks, which are small in size but large in terms of the data they store, are the most important digital evidence in many cases.
From divorce cases to labor law cases, criminal cases to commercial cases, and even intellectual property cases, the data contained in hard disks help to clarify incidents.
With Forensic Defence experts, we examine digital evidence in your judicial or administrative investigations on your behalf within the framework of the law and prepare expert opinions/reports following the Criminal Procedure Code and the Civil Procedure Code that can be used in Turkey or any other country in the world.
If necessary, these reports can be supported by testimony from the expert providing the opinion under the Criminal Procedure Code.
For more details and information don’t hesitate to contact us.
