Digital forensics and evidence FAQ
Answers for employers, HR teams and lawyers on collecting devices and accounts, recovering deleted and cloud data, chain of custody, phones, and what a forensic report needs to stand up in a dispute.
Collecting evidence
Stop using it. Do not let IT reissue it, log into it to have a look, or run a cleanup. Every login changes timestamps and can overwrite deleted data. Put it in a drawer, note who has had it and when, and arrange for a forensic image. The same applies to their mailbox and cloud accounts: suspend sign-in rather than deleting the account, because deleting a Microsoft 365 user starts a countdown on their mailbox and OneDrive.
A bit-for-bit copy of a storage device, including unallocated space where deleted material can remain. It is taken with write-blocking so the original is not altered, then verified with a hash value so anyone can later confirm the copy matches. Analysis happens on the copy, never the original.
Copying files with Windows Explorer changes metadata, misses deleted data and leaves no verifiable record. That is fine for business continuity, but weak as evidence. ISO/IEC 27037 sets out internationally recognized practice for identifying, collecting, acquiring and preserving digital evidence, and NIST SP 800-86 describes how forensic techniques fit into incident response. Following that kind of practice is what lets someone explain later exactly what was done.
Deleted and cloud data
Sometimes. On traditional hard drives, deleted data often remains until it is overwritten. On modern solid-state drives, a background process called TRIM can clear deleted blocks quickly, so recovery is less predictable. Even when the content is gone, traces such as file names, link files, browser history and USB connection records often show that a file existed and what happened to it.
Yes, and it can be the most useful evidence. Audit logs record sign-ins, file downloads, sharing and mailbox access. The catch is retention: logs are only kept for a set period depending on your licence and settings, so they should be exported or placed on hold early. Mailboxes and OneDrive accounts can be preserved with holds before anyone leaves or is investigated.
You generally cannot access an individual's personal accounts without consent or a court order. What you can usually examine is your own equipment and accounts, which often show uploads to personal services, the account names used and when. Whether you can go further is a question for your lawyer.
Chain of custody and hashing
A written record of who had each item of evidence, when, where it was stored and what was done to it, from collection to court. Gaps invite the argument that evidence was altered. A simple form started on day one, signed at each handover, avoids most of the problem.
A hash is a fixed-length fingerprint calculated from data. Change one bit and the hash changes completely. Recording the hash at collection and again before analysis or production lets anyone confirm the evidence has not changed. It is the practical answer to 'how do we know this is what was on the laptop?'
Sections 31.1 to 31.8 of the Canada Evidence Act deal with electronic documents. The person seeking to admit an electronic document must prove it is what it claims to be (s. 31.1), and the best evidence rule can be satisfied by proof of the integrity of the electronic documents system that recorded or stored it (s. 31.2). Ontario's Evidence Act has comparable provisions for electronic records in s. 34.1. Good collection records and hashing are how the technical side supports those arguments; how they apply to your matter is for counsel.
Phones and messaging
Often, depending on the device model, operating system version, whether it is locked and whether the person cooperates. Encrypted apps can usually be examined on an unlocked handset, and cloud backups can sometimes fill gaps. Results vary, so a realistic scope conversation comes before a promise.
Usually only with the owner's informed consent or a court order. Bring your lawyer in before asking. A well-drafted consent that limits the search to agreed dates, contacts or keywords is often easier to obtain and to defend.
Screenshots are better than nothing if the messages might disappear, but they lose metadata and are easy to challenge. Take them as a stopgap, keep the device untouched, and arrange a proper extraction.
Reports and court
The scope and instructions, what was collected and how, hash values, the tools and methods used, the findings with supporting artifacts, and the limitations, meaning what could not be determined and why. A report that states its limits is more credible than one that overreaches.
We offer expert-witness work, including reports prepared for litigation and testimony on the methods and findings. An expert's duty is to the court, so findings are reported whichever way they cut.
As early as possible. Counsel shapes the scope, manages privilege, handles consent and court orders, and decides what is produced. The earliest technical step, preservation, is cheap; trying to rebuild evidence after a device has been reissued is not.
Related.
- ServiceDigital forensics in Toronto: computers, phones, Microsoft 365 and Google WorkspaceIT Rapid Support provides digital and computer forensics services for businesses in Toronto, the GTA and Ontario, focused on Microsoft 365, Exchange Online and Google…
- GlossaryChain of custody (digital evidence)The documented record of who collected, held, transferred and examined an item of digital evidence, from the moment it was identified to the moment it is presented or…
- GlossaryHash values and forensic imagesA plain-language explanation for lawyers, HR and managers of what a hash value is, how a forensic image differs from a copy, and how to read the hash references in a…
- ServiceDeparting employee and IP theft investigationsAn employee has resigned, possibly to a competitor, and you need to know whether they took client lists, pricing or source files.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.