020 7193 4905

Computer Forensics

Computer Forensics also commonly referred to as Digital Forensics, encompasses the acquisition and preservation of data in a forensically sound and court admissible manner from devices running any modern operating system, across PCs, laptops, servers, mobile telephones, smart phones tablet devices, network and cloud infrastructure. We are regularly tasked to acquire data on anything from local storage right up to enterprise level RAID configurations.

The acquisition and preservation phase is arguably the most critical in an investigation as this is where unintentional modifications to data can destroy the evidential chain and potentially collapse a case before it even begins.

Digital Forensics Lab


Analysis of acquired data is performed in one of our three secure forensic laboratories using a wide range of trusted applications on dedicated analysis workstations. Analysis and acquisition is fully documented with contemporaneous notes and the provision of a forensic technical report or witness statement ready for tribunal or court.


How We Can Help


Digital evidence is fragile and if evidence from a computer forensics investigation is to be used in civil or criminal matters, the process for the acquisition, analysis and preservation of digital evidence is reliant on adherence to the ACPO Guidelines.

Our computer forensic specialists are highly-experienced and have been working in this field for over 20 years, working on commercial, civil and criminal investigations in cases including child protection, rape, harassment, fraud, abuse of privilege, murder, deception, people trafficking, drugs, theft and forgery, amongst many others. Our team has extensive expert witness experience including by appointment of the Crown Prosecution Service. The First Response team has also worked closely with the Metropolitan Police, Greater Manchester Police, and Europol.


Where We Can help


Computer forensic investigations can be complex and sensitive, be it an HR investigation, Intellectual Property theft, fraud & forgery, financial tampering, computer crime, advanced persistent threat detection, or business email compromise, they require organisations, law firms, and government bodies to follow digital trails to piece together facts that lead to the truth. We are regularly instructed to retrieve and report on numerous forms of digital evidence, including but not limited to:

  • Audit & access of Office 365
  • Email correspondence
  • Deleted files, folders, emails & messages
  • Instant messaging & social media communication
  • Application history
  • Internet activity and history
  • Theft of electronic intellectual property
  • Computer servers & network infrastructure


The type of service you are likely to need is unique to your situation – there is no “one size fits all” approach that works with a forensic investigation. If you’re not sure whether a forensic examination is appropriate, we’re happy to have a free confidential discussion about your situation so you’ll have a clear understanding of the limitations and benefits of undertaking this work.

ACPO Guidelines


Our processes follow the ACPO* Guidelines for dealing with Electronic Evidence, which ensures our work will withstand scrutiny at court or tribunals. Our analysts are experienced court expert witnesses and stand ready to assist you interviewing technical staff who may otherwise try to confuse non-tenchnical managers dealing with incidents.

First Response identify, secure, collect and analyse digital evidence on behalf of the legal and accountancy professions, corporate clients and public bodies, including law enforcement agencies. We provide clear guidance about keeping your information assets secure and have in-house expertise to help you prevent similar incidents from recurring.

Our Forensic Readiness Planning service will not only assist with regulatory compliance, but will help ensure that when an incident occurs in the future, you are better prepared to deal with it.

If you would like to know more about computer forensics, data investigation and how it is best employed or to see how we can help, call us on 020 7193 4905 for a no obligation discussion.

*ACPOAssociation of Chief Police Officers. This group produced a wonderful document which sets out the framework that analysts around the world follow when dealing with electronic evidence. You can download a copy for yourself here: Good Practice Guide for Computer based Electronic Evidence.


Computer Forensics Investigations


When a computer, mobile telephone, satellite navigation system, laptop, digital camera, server or any device capable of storing data is used to retrieve, edit or store that data, then those actions leave traces of activity. Even deleting data leaves traces of the command used to carry out the deletion. In forensics, this is known as Locard’s Principle; the idea that “every touch leaves a trace”.

Our forensic scientists use the latest tools and techniques, some of which we have developed, to analyse these traces and provide a compelling narrative of exactly what happened on a device during the period in question.

We have a lot of experience in analysing the data embedded in files that most people aren’t aware even exist. For example, the editing details stored in Office documents, the GPS location data embedded in digital photographs, the timestamps encoded within Internet history, the unique user identifiers associated with computer files, and so on.

Our processes are all about discovering the truth, so in cases where the accounts of those involved are less than reliable, we are very well placed to assist you sort truth from fiction, based on scientific fact.


Digital Evidence


First Response’s computer forensics experts help ensure no digital evidence is overlooked and can assist at all stages of a digital forensics investigation or litigation, regardless of the number or location of data sources.


Cyber Crime Investigation

Using First Response’s combination of computer forensic expertise and traditional investigative techniques, we examine physical and digital evidence to uncover what did or did not happen.


Data Preservation

In the event of an investigation or litigation, First Response offers cost-effective and defensible methodologies and solutions to identify and preserve electronic data.


Data Collection

We have the capability for onsite data collection and are often called upon to covertly collect data. Regardless of the volume and complexity of your collection needs, our team deploys forensically sound, best-practice methodology to gather your data for electronic investigation and forensic analysis, or forensic discovery. Collecting data quickly is key to preventing tampering or destruction.


Data Recovery and Forensic Analysis

Whether data was deleted or manipulated on purpose or by accident, using industry-leading tools First Response’s digital forensics specialists analyse the digital clues left behind to quickly and defensibly uncover critical information. Often this information is key to identifying and understanding incidents of misconduct.


Expert Testimony and Reporting

Our experts have the necessary experience and credentials to creditably serve as an expert witness.


Remote Data Download

We can securely and remotely collect data via the internet. Including from Apple iCloud, DropBox, G Suite, Google Drive, Microsoft 365, Microsoft OneDrive and other cloud services.

Forensic Services

Digital Forensics

Video & Audio Forensics

Audio Forensics

Video & Audio Forensics

Video Forensics

Digital Forgery

Workplace Investigations