Case Studies

Data Recovery from Crashed Heads

A "head crash" occurs when the heads of a hard disk drive.....read more >>

Seismic Data Conversion

A data acquisition client approached us with their 3D marine.....read more >>

Failed RAID Array

Where two drives simultaneously fail or the RAID is degraded.....read more >>

Half Inch Tape

One of our customers approached us with a half inch IBM.....read more >>

Data Forensics

ACPO Guidelines for Electronic Evidence.....read more >>

Magneto Optical Drives

DICOM (Digital Imaging and Communication in Medicine) has become the standard medical image format.....read more >>

Sticktion Problems

When Regal Petroleum wanted to revisit seismic surveys.....read more >>

Electronic/Firmware Failure

When the external electronic components have.....read more >>
 
Contact Data Storage Specialists by e-mailemail us for advice
Contact Data Storage Specialists by phone0800 223 0162 new enquiries
or direct dial 029 2070 6360
Terms & Conditions
Registered Company: 05513674
VAT No: 803 1178 66
 

ACPO Guidelines for Electronic Evidence

The Association of Chief Police Officers (ACPO) publish guidelines for handling electronic evidence and it is important that these are strictly adhered to when investigating computers or digital media.

Four principles are involved:

Principle 1: No action taken by law enforcement agencies or their agents, should change data held on a computer or storage media, which may subsequently be relied upon in court.

Principle 2: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

Principle 3: An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.

Principle 4: The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to.

In practice this means that a chain of custody needs to be established, ensuring that no unauthorised access to the media can occur. When interrogating the media, it is necessary to use a write-blocker, so that the data cannot be altered or overwritten. Only approved forensic tools should be used and all interrogations completed on a forensic clone of the media, not on the original media.

In a minority of cases, it may not be possible to obtain an image using a recognised imaging device. In these circumstances, it may become necessary for the original machine to be accessed to recover the evidence. With this in mind, it is essential that a witness, who is competent to give evidence to a court of law, makes any such access.

Fujitsu
Maxtor
HP
Hitachi
IBM
Samsung
Seagate
Western Digital
Windows
Apple
Red Hat
Linux
Unix
Ubuntu

Data Storage Specialists is part of a wider group of companies incorporating:
Data Recovery Specialists | Data Conversion Specialists | Computer Forensics

Data Recovery, Data Conversion and Data Forensic Specialists are a trading name for Data Recovery Services Ltd
Registered Number 04417876 VAT Number 803 1178 66

website designed & developed by IT Pie
web design cardiff