A mobile phone, a memory card and a laptop have been brought from the crime scene to the lab for investigation. Imaging technicians have taken a forensic copy of the devices. Now the electronic data must be analysed and interpreted.
Using specialist forensic software, we will probe and analyse the acquired forensic image to see if any data is present that could be relevant to the investigation. The analysts often have to sift through mountains of data to uncover patterns of behaviour and evidence to connect or disconnect people with crime. This could involve retrieving a deleted text message from a mobile phone SIM card to find the time and date an incriminating message was sent. Or it could mean extracting a photograph from a memory card, and analysing it to find the camera that took the picture. It could even be as obscure as tracking down an incriminating email deleted from a laptop several years ago.
Analysing and interpreting digital media can paint a picture or timeline that shows how data has been created and used. It helps put data into context and can often help to prove or disprove alleged offences should an investigation go to court.