Forensics Recovery

UniRecovery’s forensic specialists have established a formidable reputation amongst litigation firms as leading data forensic experts. Their tasks involves painstakingly meticulous work which could only be carried out by a highly qualified and experienced team headed by a former security specialist competent to perform on-site evidence forensic recovery investigations, providing expert witnesses for the courtroom with analysis of computer hardware damage and handle legal forensic recovery cases such as:

• criminal
• civil litigation
• human employment proceedings
• corporate sabotage & the misusing company information
• suspected security breaches
• malicious mails & sexual harassment paedophilia and many others

Equally and unknowingly, a large amount of data is stored on any given computer, which UniRecovery is capable to locate or delete, if required, beyond recovery to the satisfaction of the US Defence department. It is extremely difficult to remove information from a system beyond rtecovery than is widely understood!

Whenever companies encounter economic crime, fraud, or allegations of financial irregularity or find themselves involved in an investigation or a dispute, they will need to be able to make effective use of electronic evidence.

UniRecovery technologies provide a range of investigative services to establish the facts and to recover all hidden data evidence in the appropriate forum. The retrieved data is then analysed in a manner that is evidentially sound for use in court, should the need arise, using the same tools and techniques as the UK law enforcement agencies and regulatory bodies.

Its formidable forensic team headed by a former defence security specialist also processes large volumes of documents, e-mails and accounting transactions in order to support legal disputes or investigations.

In addition, the team helps companies that have been the victim of computer misuse or cybercrime by examining computer records, recovering previously deleted material and searching for electronic 'footprints', which may provide evidence as to what has occurred.

UniRecovery's forensic technology & cybercrime services include:

• Investigation of suspected security breaches
• Inappropriate material in the workplace
• Suspected disclosure of confidential information
• Maintaining security during and after employee/contractor/vendor termination
• Data mining and analysis of data
• Secure data capture
• Document imaging and management
• E-mail analysis and internet abuse investigations
• Corporate insolvency
• Forensic technology solutions (computer-based evidence gathering and examination)
• Disputes and claims.
• Discreet Commercial Investigations Statutory appointed investigations:
• Statutory appointed investigations.
• Investigations into industrial espionage.
• Fraud and economic crime investigations we can:
  • Determine if there’s been fraudulent activity.
  • Determine how it was carried out.
  • Find the deleted incriminating documents to identify the likely perpetrators.
  • Establish the location of missing funds and start action to recover it.
  • Prepare case files for civil recovery and criminal prosecution.
  • Prepare and deliver court evidence.
  • Advise on how to minimise fraud.
• Risk of fraud in your organisation.
• Require an investigation into fraudulent activities in your organisation.
• Significant accounting irregularities.
• Your business strategy and analysis are always leaked to your competitor.
• By offering a greater chance of maximising recoveries and/or taking effective remedial action.
• Helping to reduce the disruption to management and costs of financial and collateral damage.
• Effective action in relation to fraud can have a deterrent effect in the future.
• Assistance in dealing with law enforcement agencies, regulators etc where necessary.
• Urgently identify and secure a large amount of data and/or documentation.
• Review electronic data, including data from computers and e-mail systems, to understand what has been going on.
• Recover hidden data in order to analyse transaction data for patterns and possible fraud.
• Identify if any of your computers have been used to perpetrate a crime.
• Review internet use by your employees.

How we can support you Expertise in data capture and document management

• Use of high-tech equipment to quickly store, file and archive any hard copy or electronic data
• Ability to manipulate the data to search for key terms or patterns
• All data held will be kept in our secure forensic laboratory. Without the right processes, electronic evidence may be inadmissible in court
• We combine our advanced computing skills with the investigative knowledge acquired from forensic accountancy skills.
• Our solutions are more cost effective and timely than manual alternatives.

We have strong relationships with legal professionals, combining forensic accounting abilities with an expert knowledge of the law and legal processes.

UniRecovery deploys the same techniques to pro-actively categorize a corporation’s electronic assets, should a lawsuit ensue. A sound accounting of electronic data, and a well-articulated digital document retention policy, can lessen a company’ liability. These steps can put allow an entity to easily access data that might be exculpatory, or at least, supportive of the company in defense of a claim. Displaying a pro-active stance toward electronic discovery requests also conveys a spirit of transparency that can aid a company in the court of public opinion.

Unirecovery is involved in the investigation the suggested activities of a senior employee suspected of viewing inappropriate websites during work time on work

Unirecovery applies forensic technologies to make an evidential clone (a complete and accurate copy of the entire contents) of the employee's work computer involving:

• Producing a list of websites viewed by the employee on the computer for the past year.

• Examining pictures deleted or stored on the computer to determine if any were pornographic images

• Un-deleting previously data on the computer to study previous internet activities

• Performing a keyword search of the computer looking for traces of inappropriate material

A report of our analysis could be prepared and provided to our client's solicitors, who then passed the report on to the employee. The report would indicate:

• Inappropriate websites were regularly viewed by the employee on his work computer, both during and after business hours.
  
• Revealing any incriminating data which had been deleted by the employee, shall be recovered and included in our report.
  
• A log report of time spent browsing through illicit websites.

If the employee denies viewing pornography on his/her work computer. We are capable to evaluate his responses to our report. Should the accused otherwise such as

"It wasn't me" then the questions are begged to ask:

• Who was sitting at the desk for the last year looking at these pornographic websites?
• How do you explain that email messages and other documents were written on your computer while some of these websites were being viewed

"It was accidental".

• How can continuous access to pornographic websites on a regular basis be accidental? In some cases considerable time was spent browsing through the websites - how can this be an accident?

"When I went into the Internet, these things just popped up - I couldn't stop them".

• How do you explain that some of the viewed websites had large warning notices on their front pages.
• it was necessary to click the "ENTER" button to gain access?

Result:

• The employee can be vindicated and dismissed without a reference.

• Other members staff shall be aware of the consequences of such illicit activities.

• Compliance with the client's IT policy could improve dramatically.

As a single speck of dust entering a hard disk could cause fatal results. It is larger than the distance between the read/write heads and the platter in a hard disk (40 microns, a human hair being 100 microns thick) and its collision with the Hard Disk head would be extremely detrimental.

Our advanced laboratories are equipped with Clean Rooms rated as ‘Class 1000, 100 & 10 ’ where there exists no more than 1000 particles; and ‘Class 100’ where there exists no more than 100 particles whereas with "Class 10", less than 10 particles of 0,5 µm found in our Cabim-Flow which is of "Class 10".

The air quality of the Clean Rooms complies with the applicable standards BS 5295, ISO 14644-4 and Federal Standard 209. Hard disk fabrication requires a ‘Class 100’ Clean Room and UniRecovery undertake all laptop hard drive recovery work in Clean Rooms ‘Class 10’. Commonly established, recovery from “Clicking” hard disk drives, can also be achieved under these specialised Clean Room conditions.