Computer Forensics (Disk Image and Data Analysis)

One of the foundations of modern day computer forensics is that an analysis is never performed on the original. To that end, an ‘image’ or exact-copy (sometimes referred to as a bit-stream copy) is made of the computer disk, or other electronic media, under investigation, and all subsequent analysis is performed using the copy. Espion use specialised forensic hardware (write blocking devices) and software (typically ‘Encase’ to make forensically sound images of computers under investigation, thus ensuring the integrity of all evidence gathered. Espion can then analyse and interpret the information for evidence within the scope of a given investigation.