Computer expert analysis
Technical analysis of systems, devices or digital information carried out through documented procedures to identify relevant facts and preserve evidence.
Sánchez IT Engineering
Digital Forensics and Computer Expert Analysis of Digital Evidence
We analyze, preserve and document digital evidence for corporate investigations, incidents, disputes and processes that require technically determining what happened, applying procedures oriented to maintain integrity, traceability and reproducibility of the analysis.
Digital evidence
Any information stored or transmitted in digital format that may be relevant to an investigation: files, emails, messages, metadata, event logs and system traces.
Digital forensics
Technical discipline that applies documented procedures to identify, preserve, acquire, analyze and present digital evidence in a reproducible and technically substantiated way.
Chain of custody
Set of records and controls used to document the identification, handling, transfer, storage and analysis of evidence, maintaining traceability of who had access and what procedures were performed.
When might you need a computer expert analysis?
A computer expert analysis may be necessary when an organization, lawyer or individual needs to preserve, analyze or technically explain digital information related to an incident, dispute or investigation.
- You need to preserve WhatsApp conversations or other messaging system records.
- You need to analyze the origin, content, headers or integrity of an email.
- There is suspicion of information extraction or leakage by an employee, third party or supplier.
- An investigation of possible internal fraud or misuse of systems is required.
- It is necessary to establish when a file was created, modified, copied or deleted.
- A technical reconstruction of what happened on a computer, server or service is required.
- It is necessary to analyze records, logs, access, events or user activity.
- There is digital evidence that could be relevant in an investigation or legal proceeding.
- A technical review or challenge of a report submitted by another party is required.
- The organization needs to technically document an incident before making legal, disciplinary or administrative decisions.
What types of digital evidence can we analyze?
- Desktop computers and laptops
- Windows and Linux servers
- Disks and storage media
- Files, folders and metadata
- Photographs and digital documents
- Event records and logs
- Email and headers
- Microsoft 365 and Microsoft services
- Active Directory and Entra ID
- Cloud-stored information
- Messaging systems and digital conversations
- Authentication and access records
- Backups and enterprise system traces
The technical scope depends on the type of evidence available, the state of the devices or systems and the conditions of access to the information.
Digital forensics services
Digital evidence preservation
Controlled identification and preservation of relevant digital information, seeking to minimize alterations and documenting the initial conditions of the evidence.
Forensic acquisition
Controlled acquisition of copies, images or sets of information relevant for analysis, using mechanisms that allow documenting their integrity and traceability when technical conditions permit.
Digital forensic analysis
Analysis of files, metadata, records, events, access, systems and other digital traces with the objective of identifying technically relevant facts.
Technical incident investigation
Reconstruction of events related to access, modifications, deletion, extraction or unauthorized use of information and systems.
Technical email analysis
Review of messages, headers, metadata, delivery routes, domains, related infrastructure and other available technical elements to support the investigation of an email.
Messaging and digital conversation analysis
Technical evaluation of conversations, associated files, metadata and other available information on messaging platforms, when technically possible to preserve and analyze.
File and metadata analysis
Review of properties, dates, metadata, structure, versions and other technical attributes that may help reconstruct the origin, evolution or manipulation of a file.
Log analysis and traceability
Correlation of records from operating systems, services, applications, infrastructure, authentication, cloud and security to reconstruct events and timelines.
Technical and expert report
Documentation of the procedures performed, the evidence analyzed, the findings obtained, the limitations identified and the technical conclusions derived from the analysis.
Technical support in disputes and proceedings
Technical accompaniment to explain findings, interpret digital evidence, review third-party reports or technically substantiate the analysis performed when the scope of the case requires it.
How we perform a digital evidence analysis
IntegrityTraceabilityDocumentationConfidentiality
01
Initial assessment
We review the context of the case, the systems involved, the type of evidence available and the technical objective of the investigation.
02
Preservation
We define how to protect the relevant information and reduce the risk of alteration, loss or contamination of the evidence.
03
Acquisition
We obtain in a controlled manner the information necessary for the analysis, documenting the procedure applied.
04
Analysis
We examine and correlate the technically relevant elements to identify facts, relationships, events and timelines.
05
Report
We document methodology, analyzed evidence, findings, limitations and technical conclusions.
Digital forensics for companies
Organizations may require a digital forensic analysis to understand internal incidents, unauthorized access, information loss, data leaks, fraud, inappropriate use of technology resources or cybersecurity events.
- Information leak investigation
- Internal fraud
- Intentional file deletion
- Credential misuse
- Unauthorized access
- Post-cybersecurity incident analysis
- Investigation of privileged account activities
- Event reconstruction and log analysis
- Analysis of information in Microsoft 365, Active Directory and Windows servers
Technical support for lawyers and law firms
Digital evidence may involve systems, files, emails, messages, metadata, records and technical concepts that are difficult to interpret outside their technological context.
Sánchez Ingeniería can support lawyers and law firms in the preservation, analysis and technical interpretation of this type of information, transforming complex technological findings into clear, technically substantiated documentation.
Consult a case- Prior analysis of digital evidence
- Technical evaluation of material submitted by a party
- Technical review of third-party reports
- Email and file analysis
- Metadata and log analysis
- Preparation of technical reports
- Support for understanding technological concepts in the case
- Technical accompaniment during disputes
From the security incident to forensic analysis
A cybersecurity incident may require more than containing the problem. In some cases it is necessary to determine what happened, which systems were affected, which accounts were involved, what information may have been accessed or extracted and what technical evidence is available.
The Digital Forensics service complements the Cybersecurity capabilities of Sánchez Ingeniería through the preservation and technical analysis of that evidence.
Learn about our Cybersecurity servicesExperience in Microsoft, Windows and enterprise infrastructure platforms
Many corporate incidents occur in Windows, Active Directory, Microsoft 365, servers, authentication services, storage and corporate network environments. Our experience in these platforms allows us to analyze evidence within the real technical context in which the incident occurred.
Frequently asked questions about computer expert analysis
- What is a computer expert analysis?
- A computer expert analysis is a technical analysis of information, systems or digital devices carried out with a documented methodology to identify relevant facts, preserve evidence and technically explain the findings obtained.
- What is digital evidence?
- Digital evidence is any information stored or transmitted in digital format that may be relevant to an investigation: files, emails, messages, metadata, event logs and system traces.
- What is digital forensics?
- Digital forensics is the technical discipline that applies documented procedures to identify, preserve, acquire, analyze and present digital evidence in a reproducible and technically substantiated way.
- What is a hash and what is it used for?
- A hash is a mathematical value calculated from a file or set of data. In forensic analysis it can be used as one of the mechanisms to verify whether a copy retains the same digital content as the element from which it was originally calculated.
- What is the chain of custody of digital evidence?
- It is the set of records and controls used to document the identification, handling, transfer, storage and analysis of evidence, with the objective of maintaining traceability of who had access to it and what procedures were performed.
- Can a WhatsApp message be analyzed as digital evidence?
- It can be the subject of technical analysis, but the value of the analysis depends on the information available, how it was obtained and the additional elements that allow evaluating its context, integrity and traceability. A simple screenshot does not always contain all the necessary technical information.
- Is a screenshot sufficient as digital evidence?
- A screenshot can serve as an initial reference, but it normally contains less technical information than the device, the original conversation, the associated files or the available metadata. When possible, it is advisable to preserve the original source.
- What should I do if I have possible digital evidence?
- Avoid unnecessarily modifying, forwarding, copying or manipulating the information or devices involved. Before making changes, seek technical guidance to define the best way to preserve the available evidence.
Do you have possible digital evidence?
Avoid unnecessarily manipulating the devices, files, emails or conversations involved. Tell us the context of the case and we will technically evaluate the next steps.
Contact us about your case
Share the context of your case. Our team will review your request and help you define the appropriate technical path.
Do not include passwords, credentials or highly sensitive information in this form. After the initial contact we will define an appropriate channel to share technical information related to the case.