Computer Crimes Laboratory // Digital Evidence Division
Lab Online
Digital evidence acquisition, forensic examination, recovery, incident analysis and technical findings for matters where the computer, device, account or data itself is evidence.
Storage media / board-level examination / data recovery / source preservation.
Computer and digital evidence work requires a different mindset from ordinary repair. The question is not simply whether a device can be made to work. The question is what the available evidence can establish, how it can be preserved, and whether the technical findings can be explained clearly.
Preservation and acquisition of digital media with integrity verification and documentation appropriate to the evidence source.
Examination and recovery of available data from deleted, damaged, inaccessible or problematic digital storage media.
Analysis of files, metadata, logs, timestamps and system artifacts to establish relevant activity and chronology.
Technical examination of suspected compromise, unauthorized access, malicious activity and artifacts left on affected systems.
Examination of messages, headers, account records, metadata and related artifacts for source, context and chronology.
Technical examination of suspicious software, malicious files, persistence mechanisms and indicators of compromise.
Organization of technical findings into understandable reports and supporting material for attorneys, investigators and clients.
Assistance with locked, hacked, disabled or compromised Facebook, Instagram, X/Twitter, TikTok, LinkedIn, Google, Microsoft and other online accounts, including platform support coordination and identity-verification procedures.