In our line of work, we have to be flexible for our clients and yesterday was a good example of this. We were in a client meeting when we got a call from another client requesting their mobile and laptop be preserved for a litigation case they are currently involved in, the device forensics work needed to be carried out urgently. Luckily we know the client so there was no requirement for KYC/due-diligence checks and we were able to head back to the office, prioritise the task, arrange to pick up the devices and start work immediately.
A common misconception about forensics process is that it’s quick. Most people believe that with today’s available technology device forensics is a one-touch button and within a couple of minutes we will have what we need and also the answer to whether the device is compromised or we have recovered deleted data etc. When you speak to the client and tell them you need access to the device, 9 time out of 10 the first question is, ‘I need it, how long do you need it for?’
Managing the client’s expectations is key when it comes to the process and especially the time it takes to conduct a proper/detailed device forensics investigation. We must follow a set process, ensure the devices are handled and documented correctly, check every possibility during analysis and this inevitably ‘takes time.’ As well as having tools that assist in automation, the manual analysis is where the value is and where the time is taken to uncover the evidence required.
Unfortunately the process always requires us to have access to the devices that need to be examined for an unknown time period, a time period that is dictated by the amount of data on the device which can vary considerably. This client – like most – wasn’t overly concerned about the time it would take to complete device forensics on the laptop but wanted her primary phone back ASAP
We always try and accommodate our clients as much as possible especially when we need access to their mobile devices to conduct device forensic analysis; hence our services are provided at our offices or it can be wherever you are albeit your home or offices. Valkyrie understands data especially personal data and we try to assist every way we can when handling such data.
