FAQ

Frequently Asked Questions

General Questions:

Q. Do I need a Device Activity Check ?

If you have made it to the FAQ, it is likely that you do, people use computers for many hours each day and it is often the case that they use the said computer to carry out acts that are perhaps not in the best interest of the company.

Whilst your IT department may be able to tell you certain things relating to what a user has been doing, this pales when compared to the rich information you will receive from a DAC.

If you think that your employees, business partners or spouse are acting dishonestly or suspiciously, a DAC check is really the only way you will get an insight into their day to day activities.

Q. How does it work ?

You send the device to us, we forensically copy it and then analyse the copy - the original device(s) are then returned to you, your report and other findings are E-Mailed to you.

Q. What are the risks of sending my device ?

Each method of sending your device contains a level of risk, methods of transport are listed here from safest to least safest.  We recommend point-to-point courier delivery.

Zero Risk - Personal Delivery - You the client (or an employee of your company) delivers the device to our laboratory by hand.

Very Low Risk - Point to Point Courier - TFS Logistics are our nationwide courier partner who will collect your device and bring it directly to our laboratory.  Prices are around £75 - £220 each way for this service, depending on where the device is collected from.

Low Risk - Royal Mail Special Delivery - You ship your device to use via this service, in 10 years of receiving devices via Royal Mail, we have never experienced loss or damage when clients use this service, however liability for loss remains with the client should this occur.

Moderate Risk - Domestic Courier - You ship you device using FedEX, DHL or other mainstream courier.  We have experienced lost packages with these companies in the past, however all packages were eventually retrieved.

High Risk - Other Services - Shipping via Royal Mail 1st or 2nd Class, Parcel Force 24/48, Hermes, Yodel are all extremely high risk methods and we advise customers not to use these services when sending devices to us.  We have experienced device loss or damage when customers have used these services.

Q. I think my E-Mail may be compromised or being watched, can you send me the material via post instead of E-Mailing it to me ?

Yes, we can send material on a USB memory stick or print where possible - at an additional cost.  

Q. What devices can you collect from ?

A DAC can be performed on most Computers, Laptops, Mobile Phones, Tablets and Server computers.

The artefacts found vary from device to device, but we can provide you with a list of what to expect in the DAC report before you decide to go ahead.

Q. Can you come to my location if I can't send the device to CFO's lab ?

Yes, we offer this service worldwide and can visit your office or home at an additional charge.  This is typically charged at the "Travel Rate" displayed at the bottom of the main page in the additional charges section.

Q. Is it possible to carry out a DAC without taking the device or the copy of the device away from my location ?

Yes, in certain cases for security or legal reasons it is not possible to take the device copy back to our lab for analysis. In these circumstances we can perform the entire process at your location - at significant additional cost plus expenses (such as accommodation and meals).

Q. Can you do this covertly so no one else knows the device has been copied ?

Yes, we frequently copy devices covertly so that the suspect or employee is not alerted to the fact that they are under investigation.  At a significant additional charge we can also visit after hours and at weekends/public holidays.

It is important to understand the implications of the General Data Protection Regulation (GDPR) which came in to force in May 2018 - any clients seeking covert acquisitions should seek legal advice prior to instructing CFO. However, this usually does not cause any issues with the DAC process as matters of legal process override an individuals right to be notified that there data is being processed.

Q. Do you wear a uniform when you visit my premises/home ?

No, we wear a plain suit with no identifying marks.
We are able to wear smart casual (jeans) if a suit would arouse suspicion.

Q. What happens if there is a problem with copying my device at my location - do I still pay ?

If we can't make a copy of your device, because of an error on our part - No.

If we can't make a copy of your device because of circumstances created by yourself or others - Yes.

Such circumstances where you would still need to pay include (but are not limited to);

- Forgotten passwords.
- Additional encryption is present such as Bitlocker (usually on corporate devices).
- Unable to find the device or its power supply.
- The device is available for insufficient time to make a forensic copy (E.g employee leaves office).
- The device is damaged or has a fault which caused the forensic copy process to fail.
- It is discovered that you are not the legal owner of the device.
- The device is not as described or has been modified and does not function as intended.
- We are asked to leave the premises where the device is being copied or located.
- There is a risk to our experts personal safety from a third party threat.
- The device is not presented upon our experts arrival and copying would require overnight work.

In these circumstances you would only pay for the services consumed, for example if the report has not been written, that would be deducted from the total due.

Q. How do I communicate with CFO about my DAC check ?

All communication with CFO is  usually via E-Mail once a DAC has been commissioned, we are also happy to discuss a DAC on the telephone (all calls are recorded).

Q. How long does it take to make a copy of a device ?

 This is dependent on the type of device and the storage capacity that device has, some example follow

Standard office computer/laptop - From 2 to 6 hours
Standard home computer/laptop - From 2 to 6 hours
Android phone - From 2 to 6 hours
Apple iPhone - From 2 to 6 hours
Server Computer - From 4 to 24 hours  and beyond.

These are estimates based on our experiences, however information provided to us before we commence the copying process is vital - to allow us to provide you with an accurate estimate of how long a device copy will take.  In some cases it may not be possible to make a copy of the device on site, therefore such devices would be taken back to our laboratory and subsequently returned at the clients expense.

Q. I'm not a technical person, will a DAC overload me with technical jargon ?

No.

Whilst evidence must be presented in a technical manner to be valid in legal matters, the report we produce contains the technical evidence AND a layman's (plain English) explanation - so that everything presented in the report is easy to understand - whether you are a technical expert or know nothing about computers at all.

You can also ask as many questions as you wish - with regard to the evidence we have produced via the DAC.  Certain questions may require additional analysis (at an additional fee) to answer - but we will let you know of any costs before they are incurred should that be the case.

Q. I have spoken to other forensic companies who can do something similar to a DAC for half the price, can you do a discount ?

In the world of computer forensics, as with many other things in life - you get what you pay for.

Competitors charging significantly less that CFO will be most likely using template reports  (generic, vague and not hand crafted as ours are) and inexperienced junior staff members to produce their findings. 

Whilst you may be assured that the "head expert" will be doing the work - that's most likely just not true.  

Highly experienced experts cannot and do not work for next to nothing - they may proof read a report produced by a junior member of staff, but they certainly won't be investigating (the crucial part of a DAC) your case personally.

Would you trust something as serious as your matter to an apprentice or junior staff member ?

It is a good idea to check any potential experts level of experience using LinkedIn.

Timescale Questions:

Q. How soon can I get a DAC ?

We do book DAC's into time slots - however it is often possible to perform the collection phase of a DAC within 24 hours for urgent matters (at a significant additional cost).

Q. How long does it take to get the report back from a DAC ?

This is dependent on the complexity of the findings, but as a rule it is usually 

Economy & Standard  Service - up to 14 working days.
Premium Service - up to 10 working days.

In both all cases it is common (but not guaranteed) to receive a report within 7 working days.

It is possible to upgrade any DAC to an Express service at a significant additional cost.

Express Service -  2 to 3 Working days.

Q. What is the DAC cancellation policy ?

DAC's have a scheduled start time, which is agreed at the time you commission the DAC.  Cancellation charges are based upon this date and time.

a. 72 hours (3 days) notice you will received a 75% refund.
b. 48 hours (2 days) notice notice you will received a 50% refund.
c. 24 hours (1 day) notice you will receive 25% refund.
d. Less than 24 hours notice, you will receive 0% refund. 

In all cases of cancellation (a, b, c or d) the client must pay any incurred expenses in addition to the DAC fee.  These are usually those which are non-refundable such as air/rail fares, accommodation or other expense that has been booked by CFO in advance of the DAC.

Cancellations must be made via E-Mail.

Q. Can I change the date of my DAC once it is booked ?

Yes, we do however require 72 hours notice to reschedule a DAC and move it to an alternative date/time - non-refundable expenses  (including, but not limited to accommodation and travel fares) will be charged when a DAC is rescheduled.

Q. How many times can I reschedule my DAC ?

A DAC can be rescheduled a maximum of 2 times, there is a £150 administration fee payable for each rescheduled DAC once it has been reorganised twice. 

Q. Once I purchase my DAC, is there an expiry period ?

Yes, DAC's must be carried out within 30 days of the originally scheduled start time. 

If a DAC is not executed within said 30 days, the DAC fee will be refunded, less any incurred expenses (including but not limited to evidence storage disks, accommodation, travel fares etc) and a £150 + VAT administration fee will be deducted from any refund issued.

Self Collection Questions:

Q. Can I used my I.T team to make a copy of the Device ?

Self collection of digital evidence within an organisation can cause issues with the accidental loss or damage to evidence, accusations of tampering, non-forensic collection procedures and the rejection of evidence at court or at tribunal.

We advise clients not to use their internal staff for these reasons, what usually happens here is the defendant's legal team argue the evidence was not collected in a forensic manner and thus set out to discredit anything collected and have it removed from the matter/investigation.  Not a good start for any case!

A first responders guide is available on our Downloads page, which details the common pitfalls of self collection - take a look now, it is free!

Pricing Questions:

Q. How much does a Device Activity Check cost ?

Please contact us for pricing on a DAC.

Q.  Can you peform DAC's on multiple computers, in multiple locations around the world ?

We are used to handling such requests and can travel to any safe location world wide to perform the collection phase of the DAC.

Q. Is there a discount for multiple computers ?

A small discount may be available where multiple (three or more) DAC check's are purchased at the same time.

Q.  Are there any additional costs beyond the DAC fee ?

Yes, if you ask us to travel to your location (as opposed to delivering devices to our lab), if we travel to you additional charges are limited to;

a)  Travel time (Journey time, Airport waiting time)
b)  Travel expenses (Train, Air, Taxi fares or Mileage @ 45p per mile if we travel by car)
c)  Accommodation expenses (Budget hotels if we have to stay overnight at your location)
d) Sustenance (Meals)
e) All expenses subject to a 10% Admin fee (b through d)

Q. What if I want more detail on something the DAC has found is that included in the price?

No.

The DAC is a vast net that is thrown out and catches masses of information, sometimes a client has a need for further information about something specific discovered in the DAC.

Further information can be gathered, but will require additional analysis which is charged at a flat hourly rate.  Examples of items which require additional analysis are

a) Password protected documents
b) Backups of computer other devices stored upon the device you submit
c) Backups of mobile phones stored upon the device you submit
d) Virtual machines or associated disks stored on the device you submit

Q. Do I still pay if the the device submitted to CFO for analysis turns out to be empty/wiped ?

Partial payment will become due, but work not carried out (such as analysis and report writing) will be deducted from the total amount payable.

Q. Do I have to pay VAT on top of the DAC check price ?

Yes, CFO is registered for VAT, thus it is chargeable at the current rate (20%).

Q. Can I see what a report looks like before I commission a DAC report ?

Yes, we have a demo report, please contact us by telephone to discuss.

Q. Can I pay in instalments for my DAC ?

Yes, the DAC is formed of 3 stages;

1. Evidence preservation
2. Evidence processing
3. Evidence analysis 
4. Reporting

It is possible to pay for each stage (in advance) thus allowing you to make 4 smaller payments as opposed to one larger one.  Each stage of the DAC will be completed as you pay for it.


Q. When do I have to pay for my DAC ?

Payment on account is required for all DAC checks that are not commissioned by limited companies (businesses).  This means if you are not a business owner, or employed by a limited company,  funds for the DAC must be received into our company bank account prior to the device being sent to us, or our experts arrival at your location.

Q. How do I know that this is not a scam website and that I will pay my fee and receive nothing ?

Simple, call any of our referees on our main website  www.computerforensicsonline.co.uk and ask them if they were happy with the service they received!   You can also check out our membership with the Association of British Investigators, you may contact the current secretary of the ABI a Mr Tony Imossi to verify our credentials.  You can also read here how the ABI aided law-enforcement in bringing a bogus private detective to justice.

Confidentiality, Data Protection & Legal Questions:

Q. Is this legal ?

Yes, if ;

a) An employee is using a company owned computer and you are authorised to carry out investigations for the company (such as the IT Manager, Personnel Manager, CEO, Owner etc..).

b) You are the owner (or pay the bill on a contract) of a device.

c) You are married and thus jointly own any given device (also known as matrimonial property)

No, if;

a) You do not own (or pay the bill on a contract) the device.

b) The device is personally owned by an employee but used for company business also known as "Bring Your Own Device" (BYOD).  For these devices we can still help, but they require a different approach.

CFO will not perform unlawful (illegal) DAC checks on devices that the client does not own or jointly own.

Q. Do I need a lawyer or solicitor in conjunction with a Device Activity Check ?

No, but we do advise clients to seek legal advice should the DAC reveal information that was unexpected or could have an impact on others.

Q. Who are CFO and do you have references ?

CFO is an investigative digital forensics consultancy practice that has been serving customers for over 12 years since 2008, information about us can be found here and references can be found here.

Q. Is CFO a member of any recognised regulatory body ?

CFO is a full member of the Association of British Investigators, an organisation dedicated to vetting, inspecting and registering investigators on the private sector.

Q. Is the copy of my device and the DAC report kept confidential ?

Yes, the contents of the DAC check is only provided to the client (customer) and no one else (husband, employee, lawyer, etc..).  The exceptions to this rule are;

a) When a court of law orders CFO to disclose the DAC.
b) When CFO discovers indecent pornographic images of minors and is obligated to report this to the Police.

In such cases, all relevant material is provided to law-enforcement.

Q. Where is the copy of my device stored ?

The copy of your device is stored on a encrypted (password protected) portable USB hard drive, which is then placed in an evidence locker at the secure CFO laboratory.

Q. How long is the copy of my device and my DAC report retained by CFO ?

Device copies are stored for a period of 3 months free of charge, after which storage charges apply of £10 per month, per device copy.  After 3 months, with the clients consent, devices are usually wiped or shipped to the client (at their expense) for further storage.

For example, if you were to submit one computer for analysis, a master and backup copy would be created, meaning you would pay 2 x £10 per month for us to store them after the initial 3 months of free storage end.

DAC reports are stored for a period of 3 months, after which they are destroyed (deleted).

Q. What paperwork to I have to complete to get a DAC underway ?

Firstly, you must agree to CFO's terms and conditions of business - which will be provided when you make your initial enquiry with us.

Secondly, you will need to provide us with a "Letter of Authority" which states you are the owner of the device, or a person who is authorised to instruct CFO to carry out a DAC.  We provide this letter, you just fill in the blanks, print, sign, scan and send it back to us.

Thirdly, you will need to approve a work order document, which lists the services you are purchasing from CFO and the final price.

Q. Will CFO sign an Non-Disclosure Agreement (NDA) ?

Yes, we frequently sign NDA's to ensure that our clients data and intellectual property are properly protected.

Q. Will CFO's expert attend a tribunal, disciplinary or court hearing ?

Yes, we charge a flat day rate to attend such gatherings, plus expenses.

Q. How does General Data Protection Regulation (GDPR) affect a DAC ?

The following is a simplified breakdown of how GDPR applies to a DAC carried out on a company owned device.  There are exceptions and variations to how GDPR is interpreted and the below is intended as a general non-specific guide.  

1.)  You will need to declare a member of your company as a "Data Controller" (DC), it is this person who is responsible that "personal data" (information that can be used to identify an individual), for example an E-Mail address - is managed and controlled correctly.

2.)  You may need the consent of the "Data Subject" (DS) which is the target (or employee) of your investigation, this is almost always not required if you are investigation a matter relating to civil litigation (legal process).

3.)  The DC obtains the relevant consent from the DS's and the instructs CFO as its "Data Processor" (DP).  The DP (CFO) processes the data and carries out the relevant investigation, passing the findings back to the DP who is bound by law to ensure that the information is correctly controlled when they receive it.

As with all legal matters, we recommend that you exercise diligence an seek legal advice from a legal professional in relation the implications of aDACcarried out by CFO.

Q. What happens if my employee (the Data Subject) does not give consent ?

This is where you need to take legal advice and discuss the "lawful basis for processing" articles of the GDPR legislation.   Article 9(2) of the GDPR regulations covers these areas where you as the employer (DC) have special provisions to be legally allowed to process the personal data on the employees (DS) device.

Data Controllers (your company) also have special rights under GDPR  specifically an "organisation’s legitimate grounds override those of the individual"  which are likely to be implemented  by your lawyer/solicitor if your employee refuses to consent to process data (a laptop for example) which may contain his own personal information (such as a scan of his passport, his home address etc.). 

Q. Do I have to wait to seek legal advice before starting a DAC ?

No.

The preservation phase of a DAC can be carried out at any time, without involving a solicitor or starting a legal process.

The law stipulates that the copy of the device can be stored, but not processed, meaning we can make a copy of any device to protect it from being lost, stolen, wiped or damaged.  In the mean time the correct course of action is decided (specifically as to whether you have to notify the target employee that their data is being processed) before the remaining stages of the DAC take place.

Moving fast to preserve a device is always advised, many devices become damaged, lost, wiped or unavailable once an employee is aware they are being investigated.

Information Recovered Questions:

Q. How reliable is the Information the DAC recovers ?

Whilst it is possible to argue that a person was not at the keyboard when a certain action was carried out (known as seeking plausible deniability), the DAC provides so much information that it is very hard for a user to successfully argue that they were not responsible for any action listed in the DAC report.

The information produced in the DAC report is based upon evidence located on the device copy, this evidence cannot be changed or modified and is almost impossible to refute.

Q. Can Deleted Items be Recovered ?

Yes.

In most cases a quantity of deleted items will be recovered as part of the DAC process,
these include deleted E-Mails, Chat Messages, Files, Folders and Internet Browsing History (websites visited).  However it is equally possible that no deleted material will be recovered.

It is not possible to recover all items that have been deleted.  Due to the way a device stores information, some deleted items are lost forever after the memory or disk space used to store them is overwritten with new files.

Still have Questions ?
If you have any questions that are not answered here, please get in touch, its free !

Call us 0800 9996432
Share by: