Digital forensics: computers and laptops

When a laptop or computer comes into NFIR, a common request is to examine it for such things as the presence of rogue software, also known as malware. As a cybersecurity company, our specialists can offer help and advice should systems within your (corporate) network become compromised. Detecting the malware, defusing it and finding out how the malware got onto the system are just some of the actions NFIR can perform.

In addition, of course, NFIR can also find out what actions have been performed on the system. This is done in the case of a hack and activated malware, but also in other cases such as stalking and fraud cases. What happened, which program was started by which user and when? What documents were opened at what times and was data copied to an external data carrier? What websites were visited? Was the computer used to modify a particular document? It is even possible in some cases to recover deleted data and find traces in it. Also, examining a computer or laptop can be very valuable when a loved one has died. It is possible to secure such things as photos and personal documents of that person without login information.

Do I have malware on my computer or laptop?

There are different types of malware. You will soon notice the presence of some types of malware, because things happen on your computer that you do not trust (think of strange pop-ups, the sudden much slower functioning of your PC or functionalities that suddenly stop working). However, there is also malware whose presence you will not easily notice because it runs in the background and, for example, secretly tracks your keystrokes in order to collect passwords. So in these cases, an investigation is recommended if you still suspect something is not right. Also remember to make a (pre-)notification to the Personal Data Authority if you think personal data may have been accessed or stolen. In most cases, a good antivirus program can help. Be aware, however, that an antivirus solution does not provide complete protection.

How do I prevent my laptop or computer from being hacked?

For this purpose, so-called “basic hygiene” is very important. First of all, it is wise not to just click on all kinds of links. Clicking on a link or opening an attachment can install malware on your computer, which is the leading cause of an infected laptop or computer. Phishing via e-mail or text messages is common. Entering your information on a Web site usually won’t result in a hacked computer, but it will result in a hacked account or unauthorized access to your bank account. Fortunately, there are ways to check the authenticity of emails or text messages. Above all, remember that banks will never ask you for your information. Most companies these days already don’t send emails with clickable links. Many misspellings and a high degree of urgency are also things that can indicate phishing.

Using strong passwords for Internet accounts and business workstations is also a common tip. You can record these complicated passwords in a password manager, which will remember them for you. A password manager protects you with a master password. From now on, this password will be the only password you need to remember. The important thing here is that the password is long enough; make it a random sentence, for example. The password manager can then generate and store unique, strong passwords for all your accounts, so you don’t have to remember or invent them yourself.

Is it possible to recover my deleted files from my laptop or computer?

That’s possible. When files are deleted, they do not immediately disappear completely from the storage medium. The data disappears permanently only when the exact location where it was stored is overwritten with new data. Therefore, should you accidentally delete important data, preferably do nothing more with the storage medium in question and contact NFIR.