Fast Track Service

Government and commercial businesses are becoming increasingly concerned that sensitive issues relating to staff are not being handled properly due to the complexities of gathering relevant information from the technology related to each case.

Many organisations do not have the expertise needed to properly analyse information systems for evidence and the need for this expertise can be difficult to justify because it is hard to determine the number and nature of employee related incidents needing such analysis. However, it is often preferable to employ external experts to lend the important factor of independence to particularly sensitive proceedings.

For many years QCC have been working with our clients to refine our Incident Management and Digital Forensics services. Through feedback and experience we have devised a method and process to quickly and efficiently process digital exhibits (whilst still preserving their evidential integrity) in a way which delivers the relevant evidence in a format which can then be easily understood.

We have called this process Fast Track. It has been designed to ensure compliance with relevant legislation and the Association of Chief Police Officers (ACPO) 'good practice guide for computer based electronic evidence'. All the digital forensic investigations, including Fast Track work, carried out by QCC is done within the framework of our ISO9001 certified Quality Assurance process.

The QCC Fast Track service provides peace of mind when faced with investigations within the organisation of a sensitive or potentially damaging nature, but where a full blown forensic analysis may be difficult to fund or justify.

Some notable Fast Track cases we have worked on include the following:

• Corporate Personnel/Human Resources investigations
• fraud
• theft and bullying
• conspiracy
• copyright/data theft
• compliance and regulatory anomalies
• defamation
• sexual harassment
• asset recovery

Benefits for Clients
Fast Track provides the assurance that sensitive cases are dealt with correctly when employees or suppliers are under investigation. This is in contrast to either directly challenging the suspect and/or involving the internal IT department, thereby running the risk of corrupting or rendering potentially good evidence inadmissible

Fast Track has been devised to give access to pertinent information, found in live files within digital storage media (hard drives, memory devices, mobile phones), without the immediate need for a full forensic examination. The relevant exhibits would be imaged, or copied in a forensically sound manner to evidential standards and this step would not need to be repeated should a full forensic examination be subsequently required. The live files are copied out and provided on read-only media for detailed analysis by those conducting the investigation.

This technique allows the client’s investigators to quickly establish the relevant lines of enquiry and to use techniques with which they are familiar, without the need to understand the complex nature of the computer evidence being addressed. Typical evidential packages would, for example, include a DVD containing a complete set of Microsoft Excel spreadsheet files, Word documents and any recovered e-mails found from within the seized computer systems.

Some examples of the information discovered using the QCC Fast-Track service include:

• a receipt for the survey of a luxury yacht in an asset recovery case
• details of off-shore bank accounts
• falsification of overtime claims
• general computer misuse by staff contrary to company policy
• storage of illegal files by staff on corporate networks
• e-mail communications with suspected (and later proven) 3rd parties
• Internet history artefacts proving fraudulent use of Internet banking facilities
• evidence of hackers hi-jacking corporate web servers over several years

The Fast Track process consists of 2 phases:

Fast Track Phase 1 – Imaging

• collection of the relevant exhibits from the clients office as required
• provision and signing of an exhibit receipt log to preserve continuity
• transportation of exhibits to our laboratory
• physical examination of exhibits
• external and internal photography of the exhibits
• recording of the system clock times
• imaging of the exhibits with EnCase or another suitable system in a forensically sound manner
• production of DVDs or LTO tapes containing a copy of the forensic images of the exhibits
• sealing in tamper evident bags the original and new exhibits produced
• production of a witness statement by the technician detailing the steps in phase 1
• delivery of the relevant exhibits back to the clients office
• provision and signing of an exhibit receipt log to preserve continuity

Fast Track Phase 2 – Searches

• liaison with the case investigator regarding search criteria and job priority
• running of searches across all relevant imaged exhibits for specific keywords
• analysis across all relevant imaged exhibits for specific file types
• extraction across all relevant imaged exhibits for email records
• where technically possible, the recovery of all relevant items in their native file format
• production of DVDs containing a set of folders relating to the original exhibits containing the relevant "discovered & recovered" documents and files from the relevant exhibits
• sealing of new exhibits produced
• production of a witness statement by the analyst detailing the steps from phase 2
• delivery of the relevant exhibits back to the clients offices
• provision and signing of an exhibit receipt log to preserve continuity

Turn around times
Turnaround times vary depending on size of the case, the number and location of exhibits, the size of the hard disk drives for analysis, etc.

The Fast Track service was developed for a law enforcement client that required results within a very short time frame. QCC can usually provide an accurate turnaround estimate on a case by case basis. If a full analysis and technical report is later required the previously agreed turnaround is extended depending on the level of additional investigation required.

Search & Seizure Technical Support and Telephone support
The QCC Forensic Services Section can provide technical support via telephone for client’s investigators when they are seizing digital exhibits at a scene, so as to ensure that seizure is carried out properly and in line with relevant guidelines.

On site support
If the seizure involves more complex procedures which cannot be dealt with over the telephone, then our technical staff can be available for scene attendance and to carry out the seizure of digital exhibits on behalf of the investigators.

Support services
The cost of the QCC Forensic Services Section providing technical support either over the telephone or on-site will be charged at a previously agreed hourly rate.