All digital evidence is identified in our forensic laboratory, which adheres to international standards. Our forensic engineers, who have years of experience in their field, perform these identifications in a reliable and auditable manner, and the results are reported in compliance with the Turkish legal system.
Computer Examination
Services
With our computer examination services, we analyze data on your digital devices and uncover findings with forensic evidence value. We provide support through reliable and detailed reporting.
GENERAL PROCESS OF DIGITAL FORENSICS SERVICES
The forensic process at the Fordefence Forensic Laboratory begins with the identification of the digital material related to the crime. An image (backup) of the identified digital material is taken using write-protection methods to prevent any tampering. A technical examination related to the criminal incidents is conducted on the image using forensic software. During these procedures, historical data can also be scanned using data recovery software on the image. In the final stage, an expert opinion (mütalaa) is prepared following Articles 293 of the Civil Procedure Code (HMK) and 67 of the Criminal Procedure Code (CMK) regarding computer and hard disk examinations as part of the Fordefence Forensic Service.
HARD DISK EXAMINATION
Hard disks are mechanical devices that provide permanent and rapid data storage. Data written on the hard disk is physically recorded, so it is not erased when the power is off or the disk is stopped.
Every piece of data you record on a hard disk is stored on magnetic layers on the disk. This is achieved using magnetization principles. Each piece of data recorded is written on magnetic media, ensuring data is saved. The magnetic layers on the hard disk have circular tracks on the top, known as tracks. The layered structure of the hard disk is illustrated below.
At the Fordefence Forensic Laboratory, hard disk examinations follow the sequence outlined below;
- Image Acquisition and Verification:
The hard disk under examination is first imaged using physical devices (Tableu TD1, TD2, etc.) or software (FTK Imager, Linux DD) with write protection activated. After the imaging is completed, the hash values provided by the device or software are verified, concluding the imaging process.
- Planning and Software Selection Based on Case Subject: After the hard disk image related to the criminal activity (credit card fraud, data leakage, etc.) is identified, it is analyzed using advanced forensic software such as Encase, MagnetAxiom, and FTK.
- Scanning Existing and Deleted Data on the Hard Disk Surface:the examination involves deleted data, data recovery is performed on the hard disk image first, followed by an examination of the recovered data.
- Examining the Scanned Data:
After scanning the data with forensic software, the raw data can be examined using different software. For example, if email files (pst, eml) are extracted using forensic software, they can be more easily and thoroughly examined with software like Kernel Outlook PST Viewer.
- Report Preparation: The examined hard disks are reported in compliance with Article 67 of the Criminal Procedure Code (CMK) and Article 293 of the Civil Procedure Code (HMK) for use in judicial and administrative units. These reports, prepared by Celsiusweb experts, are valid in Turkish judicial and administrative authorities and even under international legal norms.
In Summary;
Digital evidence has become the most important evidence used by judicial authorities (Courts-Prosecutors-Lawyers) and administrative authorities (Inspection Boards-Internal Audit Units-Legal Consultancies) to clarify incidents. In this context, hard disks, which are small in size but large in terms of the data they store, are the most important digital evidence in many cases.
From divorce cases to labor law cases, criminal cases to commercial cases, and even intellectual property cases, the data contained in hard disks help to clarify incidents.
With Fordefence experts, we examine digital evidence in your judicial or administrative investigations on your behalf within the framework of the law and prepare expert opinions/reports following Article 67 of the Criminal Procedure Code (CMK) and Article 293 of the Civil Procedure Code (HMK) that can be used in Turkey or any other country in the world.
If necessary, these reports can be supported by testimony from the expert providing the opinion under Article 178 of the CMK.
For additional services provided by Fordefence in digital forensics click here
