Elementary Solutions Ltd

Computer Forensics is the detailed analysis of computer data, frequently in the context of legal proceedings or an investigation of some kind.  Computer forensic analysts first make a copy of evidential data using special tools and techniques that allow us to recover deleted data and that ensure the evidence is admissible in Court.  Then the evidence is searched and analysed using techniques appropriate to the particular situation.  We are able to recover deleted data, break passwords and reconstruct past computer activity to ascertain what happened.  Then we report our results back to you - either informally, in a formal report, by writing an affidavit for filing in Court or by appearing in Court to give expert evidence.

See Introduction to Computer Forensics for a more detailed explanation of Computer Forensics.

Applications of Computer Forensics

Computer Forensics is necessary in any situation where evidence needs to be extracted from a computer or computer media, and is likely to be useful in a range of matters including:

• Employment Investigations - including pornographic material, time wasting, breach of contract, breach of fidelity,theft/misuse of information, sabotage, sexual harrassment
• Copyright and Intellectual Property matters - information theft, breach of copyright, domain name disputes, proving date of inventions
• Insolvency - recovery of (possibly deleted) business records, reconstruction of transaction history and computer activity
• Tracking the source of anonymous email messages and Internet postings
• Peace of mind and Family Court matters
• Any civil or criminal matters where documents or other evidence from a computer or electronic media is involved

Expert Evidence

Courts use "expert witnesses" to assist in areas where specialised knowledge is required.  Computer forensics and IT is one area where expert witnesses are frequently used.  Ordinary witnesses in Court are permitted to give evidence only about matters within their direct knowledge and they are not allowed to give opinions or analysis.  Expert witnesses are people with specialist qualifications in a particular feld, such as Computer Forensics.  They are permitted to give expert evidence within their field of knowledge, which may include opinion evidence.  In the High Court of New Zealand expert witnesses must abide by the Code of Conduct for Expert Witnesses.

Courts and juries will not automatically accept the evidence of an expert witness.  It is common for each party in a proceeding to engage their own expert, and opinion evidence from experts may conflict.  The Court or jury may have to decide which expert's evidence is more reliable and therefore carries the greatest weight.  Factors that can influence this decision include:

• The qualifications and experience of the expert - particularly if the expert has formal qualifications and whether or not the expert has been published in reputable peer-reviewed academic journals
• The degree of care and diligence demonstrated by the expert in their evidence
• Whether or not the expert has followed a logical thought process and justified any preference of one possibility over another
• Whether or not the expert has demonstrated the reliability and integrity of any exhibits that form the basis of their evidence
• The standard of the expert's written evidence and/or presentation in Court

Elementary is the only computer forensic company in New Zealand actively involved in academic research in computer forensics.  We are the only computer forensic provider that requires that our expert witnesses have at least an undergraduate degree in Computer Science (or equivalent).  Elementary's owner and Principal Consultant, Daniel Ayers, is the most highly qualified computer forensic expert in New Zealand (Honours and Masters degrees in Computer Science, now engaged in Doctoral research).  Therefore if you select Elementary for your computer forensic requirements you can be assured of the best possible outcome.