Sei sulla pagina 1di 70
Computer Examinations — D/Sgt (Retired) K. J. Falconer Ontario Provincial Police — Technological Crime Unit (TCU! Orillia, Ontario * Computer forensic analyst 2001 - 2015 + 350 investigations + * Major Cases at OPP TCU * Assisted HPS with R vs MILLARD and SMICH computer examinations Ese] Forensic Copies — Imaging 3 Millard’s Residence — 5 Maple Gate 4 Device 1 - Computer HPS #1014 5 Device 2 - Computer HPS #1001 13 Device 3 - Computer HPS #1000. 52 Device 4 - Computer HPS #1013 63 Device 5 - USB Hard Drive HPS #1010 72 Forensic Quality Copies “Original exhibit is never directly examined. This can modify date and time settings, alter or overwrite the data contained on the exhibit. “Forensic quality copies or “images” of the original computer data are created using specialized forensic software and hardware. *Images are examined with additional software and reports are created that reflect the findings.

Potrebbero piacerti anche