Sorted - thanks

melwarwick · 2017-03-06T18:50:22.000Z

Sorted - thanks

kenlulue · 2017-03-06T18:59:27.000Z

First off, Welcome.

Now, as for forensic software, the answer is really the same as almost any IT question, “IT Depends”. There are many different programs out there and depending on what you are looking for, there are many options. There are memory forensics as well as drive forensics. As for phones, there are different tools depending on if it is Apple, Android, or something else.

georgemcfarlin · 2017-03-06T19:16:29.000Z

Welcome to spiceworks!

I see by your account you are in the united kingdom, this is a world wide read forum, you may want to specify what area of the world you are asking about in threads. Sorry i have nothing to offer you in regards to UK law.

melwarwick · 2017-03-06T19:19:54.000Z

Thank you!

Sorry, I didn’t know, but I’ll make sure to be aware for the future

kenlulue · 2017-03-06T19:27:21.000Z

Memory / Drive involves what is stored in RAM vs. What is stored through loss of power. My initial statement was more for PC then cell phones, but the thought process stays the same. This sounds more of a case that you think your employer has tampered with your iPhone. If this is the case, there could be a lot of other things to consider. A better description of your situation can help get you in the right direction. Asking Better Questions

What are you really looking for? What happened? Did you add your work email to a personal phone?

jakemyers5937 · 2017-03-06T19:52:54.000Z

Welcome aboard!

brianwhelton · 2017-03-06T21:30:50.000Z

First of all there is a chain of evidence to consider, whatever logs you retrieve will not be able to be admitted into evidence in a court as they are not acceptable, a log has to be turned into a business artifact for is to be admissible, this is simple to do, you need to be able to demonstrate there is a process that is proven to not compromise the quality of the logs (which are evidence) and can be replicated, normally for computers, a complete byte by byte copy of a hard drive so that multiple tests can be completed without the original being compromised.

As to the tests, this would be down to the type of evidence being sort, so it could be as simple as create SHA-1 or MD5 hashes of the files and folders contained upon the hard drive and have these compared against ‘known’ hashes to identify any interesting files, to running one of the many FrEds (Forensic Evidence) packages out there to check for pictures of known pictures using skin tone or keyword searches. This is why you require multiple copies of the same drive.

There is no easy method of doing forensics, no GUI where you press enter and a report is written.

If the phone has been compromised without your permission, I seriously suggest you contact the police in the first instance, they will have a computer crime unit capable of doing this…

brianwhelton · 2017-03-06T21:38:17.000Z

As for the latest laws, take you pick! What is suspected? If the phone has been used without permission and has caused a cost to someone, it’s theft, or possible obtaining a service by way of deception.

Computer laws? I’d start with the computer Misused act, 1990 Computer Misuse Act 1990 . Laws apply to everyone, regardless of position, however any law broken may not be computer related, there is also laws against harassment and stalking if there are concerns of monitoring someone without their permission. However if it’s a company device I would imagine a user agreement stating this was permitted was signed, if not, then there is a certain expectation of privacy, providing the employee isn’t using the phone for not business purposes, that’ll be theft of a service if only supplied for business calls.

An idea of the circumstance would aid in identifying the most appropriate law.