One of the more troubling statements we hear when we start an investigation is that the IT department has already looked at the computers for evidence. Companies that allow their IT professionals to place their size fourteen boot prints over the scene are looking for trouble!

When is the best time to image computers and mobile phones in an investigation? We have often seen that computers are not imaged because it is impossible to delete data from a computer, or the computer guys will always find the information. The truth is that computer data is extremely fragile, and once overwritten is gone forever.

See our video below for a discussion on computer forensics, and the steps that should be taken in an investigation.