Define the assignment
We define the objective, scope and authorisation for the work. We identify the media and relevant restrictions.
Evidence needs a process.
From defining the assignment to delivering results: traceability, documentation and justified technical decisions.
REKOVER FORENSICSPRECISION AT EVERY STAGE ↘
Assess the device
We review physical and logical condition, encryption and technical options. We assess feasibility and limitations before intervention.
Acquire and preserve
We select the acquisition method, document the procedure and verify image integrity where applicable.
Analyse in context
We review information relevant to the assignment. We cross-check artefacts, metadata and timelines, distinguishing findings from conclusions.
Document and deliver
We record results, incidents and limitations. We agree on the delivery format and conditions for retaining the materials.
METHOD MATTERSA result must
A result must
be explainable.
Documentation shows what was done, on which media and with what limitations. Each case requires an adapted procedure that preserves traceability.