Forensic Readiness Planning

A forensic investigation of digital evidence is commonly employed as a post-event response to a serious information security incident; this can be both time consuming and expensive. There are many circumstances where an organisation can benefit from the ability to gather and preserve digital evidence before an incident occurs; a Digital Forensics Readiness Policy details the immediate procedures to be employed for any forensic investigation of digital evidence.

Forensic readiness is defined as the ability of an organisation to maximise its potential to use digital evidence whilst minimising the costs of an investigation.

A Digital Forensics Readiness Policy should be established to confirm an organisation’s commitment:

- To gather admissible evidence legally and without interfering with business processes
- To gather evidence targeting the potential crimes and disputes that may adversely impact the organisation
- To allow an investigation to proceed at a cost in proportion to the incident
- To minimise interruption to the business from any investigation
- To ensure that evidence makes a positive impact on the outcome of any legal action, in order to continue core business functions of all Business Stakeholders in the event of a major incident.

Note: The term Digital Forensics Readiness Policy is interchangeable with Computer Forensics Readiness Policy.

An Introduction to Computer Forensics - Training For Solicitors and Barristers

Computer media can yield a wealth of information which is crucial to the outcome of a case, be it criminal or civil; but how can a computer forensics expert help you? Griffin Forensics is happy to provide a 'lunch time' talk, “Training For Solicitors and Barristers", at your practice or chambers to provide you with an understanding of some of the ways in which we can help.

We have been asked (and this often happens) to 'just print' everything that is on the hard disk drive; this is not the best use of resources and would be extremely expensive and time consuming. In "An Introduction to Computer Forensics - Training for Solicitors and Barristers" we will give you an idea of the mountains of paperwork that you would have to go through if we were to 'just print' everything.

During "An Introduction to Computer Forensics - Training for Solicitors and Barristers" we will explain:

  • the important difference between ‘imaging’ and copying’,
  • search methods and search criteria,
  • what happens to deleted files (and can they be recovered),
  • the analysis of Tablets (ie iPad), portable Sat Navs, Mobile Phones,

plus, further information which may assist when you decide whether to instruct a digital forensics expert for your next case.

Basic Computer Forensics Training - Corporate

Most businesses will, from time to time, have to deal with computer incidents which may result in litigation or employment tribunals. During Basic Computer Forensics Training we will show you how to avoid the critical failures during the early stages of an investigation which can invalidate all of the hard work that normally results from such incidents.

Unfortunately, if you make a mistake with computer evidence, the damage may not be recoverable. For example, a computer being switched on by the investigator to check for suspicious activity will change dates and times and the activity by the investigator will leave some trail.

During Basic Computer Forensics Training we will explain:

  • What to do when you come across a computer which requires investigating
  • How to deal with the computer and associated media
  • What you need to record and why
  • How to prepare a report or statement detailing your actions
  • What a Digital Forensics Readiness Policy (DFRP) is and how it could benefit your business

At the end of Basic Computer Forensics Training - Corporate you will not be a computer investigator but you will know how to deal confidently with a computer incident so as not to jeopardise any subsequent legal hearings.

The course can be tailored to your specific requirements and can be held near our offices or at a suitable venue of your choosing.

Further Information

For information about our courses call 01280 707190 or eMail