Knowledge
Guides: digital forensics
Digital forensics guides: phone and computer data, documenting examinations and interpreting digital material.
How to prepare digital material for analysis
This section contains articles on digital forensics, data from phones and computers, and documenting examination results. The possible scope of analysis depends on the device, security measures and condition of the data.
Before handing over a storage medium, describe the problem, device model and condition. Avoid deleting data yourself or installing software that could alter the material.
Scope of digital forensics services · Contact about an analysis · All articles
How should you prepare a phone for an agreed examination?
How to describe a phone, agree on the scope of examination and prepare to hand over the device. Why switching off, unlocking or updating requires prior agreement.
Read the article ↗Digital forensicsRecovering deleted messages: possibilities and limitations
What determines whether deleted messages can be recovered from a phone? Backups, encryption, data remnants and the limits of analytical conclusions.
Read the article ↗Digital forensicsHow to preserve CCTV and dashcam footage for analysis
How to prepare a recording for analysis: recorder files, incident context, device time, playback software and a description of the material's origin.
Read the article ↗Digital forensicsWhy does a screenshot not replace complete digital material?
What does a screenshot show, and what can it not establish? How to preserve conversation context, source files and information needed for analysis.
Read the article ↗Digital forensicsHow should email correspondence be prepared for examination?
How to prepare original emails, full headers and attachments for analysis. Gmail exports, Outlook data and the limitations of conclusions.
Read the article ↗Digital forensicsCloud data analysis: sources, authorisation and completeness
How can cloud account, phone storage and backup data be distinguished? Access conditions, completeness of material and cautious interpretation of a computing report.
Read the article ↗Digital forensicsSmartwatches as a data source: time and links between records
How should watch, phone and cloud data be interpreted? Synchronisation, time zones, record provenance and the limits of linking a smartwatch to a specific person.
Read the article ↗Digital forensicsSIM card examination: a copy for phone isolation and the reliability of findings
What does SIM cloning mean in MOBILedit? Data sources, limitations of a copy used to isolate a phone, and documenting analysis of the SIM, phone and eSIM information.
Read the article ↗Digital forensicsMOBILedit ULTRA—model, system and lock state in examination compatibility
How can a phone’s suitability for examination with MOBILedit ULTRA be checked? Model, OS, patches, lock status, software versions and separate verification of application analysis.
Read the article ↗Digital forensicsMOBILedit Forensic in digital forensics—functions, analytical methods and the evidential significance of mobile device data
An overview of MOBILedit Forensic functions: data acquisition from mobile devices, backup analysis and preparation of examination reports.
Read the article ↗Digital forensicsBypass, root and jailbreak—the limits of data access
What do bypass, root and jailbreak change in a phone examination? The limits of MOBILedit ULTRA, encryption, and documenting interventions and analysis results.
Read the article ↗Digital forensicsDigital forensics standards in the analysis of digital evidence
The basics of preserving and analysing digital evidence. Explore the importance of working standards, examination documentation and the role of a digital forensics expert.
Read the article ↗Digital forensicsDigital forensics—digital data analysis in criminal and civil proceedings
How are data from computers, phones and email analysed? The scope of digital forensics and the credibility of digital material in a case.
Read the article ↗Methods and procedureApplication for appointment as a court expert in Kraków—documents and fee
Information on applying for appointment as an expert at the Regional Court in Kraków: requirements, documents, fee and where to submit the application.
Read the article ↗Methods and procedureReappointment as a court expert—fee, documents and deadline (Regional Court in Kraków)
Reappointment as a court expert at the Regional Court in Kraków. A discussion of the required documents, application deadline and stamp duty.
Read the article ↗Digital forensicsDigital forensics standards—good practices, ISO standards and the significance of digital evidence in proceedings
Good practice in working with digital evidence and the role of ISO/IEC standards. Preserving material, data integrity and documenting analysis.
Read the article ↗