Forensic Information Technology Section

General information

Five people are employed in this Section.

Area of expertise

The Forensic Information Technology Section deals with digital evidence (information stored in digital form which may constitute evidence in forensic trials). Investigations encompass, among other things:

  • hard drive analysis;
  • CD and DVD analysis;
  • semiconductor memory analysis (USB memory, memory cards);
  • mobile phone memory analysis.

The goal of all analyses is to find specific pieces of information (for instance, information contained in documents or in electronic mail), images, audio and video recordings as well as traces of events such as establishing connections with other computer systems, sending and receiving data, creation and deletion of files, connecting to and using peripheral devices.

Tools and equipment

The basic tool for forensic information technology analyses is computer equipment with appropriate interfaces and forensic software; however, specialist knowledge on information technology and electronics is also essential. Improper handling of digital records may lead to corruption or unrecoverable loss of data, which is why the Forensic Information Technology Section has adopted internationally accepted standards of procedure, which describe how digital evidence should be handled, analysed and documented, with the aim of ensuring reliable examination of digital evidence.