POLAND · EUROPEAN UNION
Examination of computers, phones and storage media for judicial proceedings and private forensic assignments.
ObjectivityConclusions based on technical findings
Data integrityPreservation and documentation of evidence
Transparent methodologyDocumented procedures and limitations
More than 20 yearsof experience
Several hundredcases handled across Europe
Subsidiarieswithin the European Union
THE LABORATORY
Networks Concept identifies, preserves and analyses digital traces stored on devices and computer systems. Reports set out the technical findings, their interpretation and the limitations of the examination.
The laboratory uses the latest generation of forensic acquisition and analysis tools. Methods are selected according to the type of storage media, the protections encountered and the objectives of the assignment.
AREAS OF ANALYSIS
Examinations tailored to the evidence, the condition of the device and the purpose of the assignment.
Examination of computers, servers, HDDs, SSDs, USB drives and memory cards.
Analysis of file systems, documents, metadata and traces of user activity. Reconstruction of event timelines and relationships between items of evidence.
Recovery of deleted data depends on factors including overwriting, encryption and the condition of the storage medium.
Examination of mobile devices, communications, application data and media files.
Analysis of available data from iOS and Android devices: messages, call history, photographs, videos and application artefacts. Correlation of information and timestamps.
The scope of acquisition depends on the device model, operating system version, security features and device condition.
Acquisition and analysis of recordings from video surveillance systems and NVR and DVR recorders.
Examination of video files, metadata, recording continuity and timestamps. Verification of clock settings and comparison with other data sources.
Findings take account of image quality, recording format, the available time period and any gaps in the material.
Data acquisition and the creation of copies for further examination of digital evidence.
Selection of acquisition methods suited to the medium and the purpose of the examination. Documentation of procedures, integrity verification using hashes where technically possible, and examination of copies where appropriate.
Data recovery is subject to a technical feasibility assessment and cannot be guaranteed.
Examination of available data from connected devices, associated applications and storage media.
Analysis of event logs, configuration, telemetry data and media files. Correlation of traces from the device, its controller and the associated application.
The possibilities for examination depend on the device model, data availability and storage methods.
Analysis of internet traces, electronic communications and system events.
Examination of browsing history, email, available application data and system logs. Reconstruction of events and analysis of traces of unauthorised access within the scope of the assignment.
Technical findings are distinguished from legal assessments and from hypotheses that cannot be substantiated by the evidence.
METHODOLOGY
Each stage makes the examination transparent and allows the basis of the findings to be assessed.
Defining the questions, the purpose of the analysis and the evidence to be examined.
Selecting methods and documenting procedures according to the type of device.
Identifying the evidence, checking its integrity and documenting its transfer.
Locating, verifying and correlating traces within the scope of the assignment.
Presenting the methods, findings and conclusions, together with material limitations.
The report explains the basis of the findings and distinguishes observed data from interpretation. Gaps in the evidence and uncertainties are clearly described.
QUESTIONS AND ANSWERS
Key information about the scope of an examination and preparation of the evidence.
Identification and acquisition of data, examination of files and activity traces, comparison of information from different sources, and preparation of a report. The precise scope is defined for each case.
No. Overwriting, encryption, damage to the storage medium and device security features may limit or prevent acquisition. Feasibility must be assessed against the specific evidence.
Not in every case. A trace associated with an account or device does not always establish who actually performed an action. Conclusions take account of context, the available evidence and alternative explanations.
Useful information includes the type and number of devices, their known condition, the relevant time period and the questions to be addressed. Any previous handling of the devices should also be described. Arrangements for transferring the evidence must be agreed in advance.
The laboratory is located in Warsaw, Poland. It also has subsidiaries within the European Union.
Yes. Requests are submitted through the contact form. The laboratory assesses the technical feasibility of the project and agrees the scope of the assignment with the requester. With prior agreement, devices and storage media can be sent by secure transport or delivered to a European subsidiary, following arrangements agreed with the laboratory. Submit a forensic examination request.
NETWORKS CONCEPT LABORATORY
Specify the devices involved, the questions to be examined and any deadlines. Arrangements for transferring devices and storage media must be agreed with the laboratory before anything is sent.
Back to top