{"id":3779,"date":"2024-02-08T15:33:17","date_gmt":"2024-02-08T15:33:17","guid":{"rendered":"https:\/\/qccglobal.com\/?page_id=3779"},"modified":"2024-06-06T14:38:30","modified_gmt":"2024-06-06T14:38:30","slug":"digital-forensics-case-studies","status":"publish","type":"page","link":"https:\/\/qccglobal.com\/digital-forensics-case-studies\/","title":{"rendered":"Digital Forensics Case Studies"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3779\" class=\"elementor elementor-3779\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-df71ce5 e-flex e-con-boxed e-con e-parent\" data-id=\"df71ce5\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-eddcb51 elementor-widget elementor-widget-spacer\" data-id=\"eddcb51\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.22.0 - 17-06-2024 *\/\n.elementor-column .elementor-spacer-inner{height:var(--spacer-size)}.e-con{--container-widget-width:100%}.e-con-inner>.elementor-widget-spacer,.e-con>.elementor-widget-spacer{width:var(--container-widget-width,var(--spacer-size));--align-self:var(--container-widget-align-self,initial);--flex-shrink:0}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container,.e-con>.elementor-widget-spacer>.elementor-widget-container{height:100%;width:100%}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer,.e-con>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer{height:100%}.e-con-inner>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer>.elementor-spacer-inner,.e-con>.elementor-widget-spacer>.elementor-widget-container>.elementor-spacer>.elementor-spacer-inner{height:var(--container-widget-height,var(--spacer-size))}.e-con-inner>.elementor-widget-spacer.elementor-widget-empty,.e-con>.elementor-widget-spacer.elementor-widget-empty{position:relative;min-height:22px;min-width:22px}.e-con-inner>.elementor-widget-spacer.elementor-widget-empty .elementor-widget-empty-icon,.e-con>.elementor-widget-spacer.elementor-widget-empty .elementor-widget-empty-icon{position:absolute;top:0;bottom:0;left:0;right:0;margin:auto;padding:0;width:22px;height:22px}<\/style>\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9cc9b9c e-flex e-con-boxed e-con e-parent\" data-id=\"9cc9b9c\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-c7a904c e-con-full e-flex e-con e-child\" data-id=\"c7a904c\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6c37de6 elementor-widget elementor-widget-image\" data-id=\"6c37de6\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.22.0 - 17-06-2024 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/employee-theft-of-customer-info.webp\" class=\"attachment-large size-large wp-image-9757\" alt=\"Employee Theft Of Customer Info\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-400695d e-con-full e-flex e-con e-child\" data-id=\"400695d\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ab35370 elementor-widget elementor-widget-heading\" data-id=\"ab35370\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.22.0 - 17-06-2024 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">Employee theft of customer information<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-668ddb1 elementor-widget elementor-widget-text-editor\" data-id=\"668ddb1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.22.0 - 17-06-2024 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>QCC received a call from the worried CEO of a company whose business involved leasing high value items to private individuals. He suspected that his sales director was planning on leaving the company with a copy of the customer database to join a rival start up business. QCC were able co-ordinate with the company solicitors and execute an Anton Pillar civil search and seizure order. This involved QCC\u2019s investigators visiting the new company\u2019s offices and the directors homes and seizing servers, workstations, laptops and other items.<\/p>\n<p>Items identified in the forensics analysis of the seized exhibits included numerous contract templates and other intellectual property created by QCC\u2019s Client as well as their customer data base. QCC analysts were then able to present their findings to the Client\u2019s council, leading to a successful court order limiting the planned new business operation and recovering significant compensation and costs.<\/p>\n<p><strong><a href=\"https:\/\/www.qccglobal.com\/contact-us\/\">Contact us<\/a><\/strong>\u00a0for further advice or return to\u00a0<strong><a href=\"https:\/\/www.qccglobal.com\/digital-forensics-services\/\">digital forensics services page<\/a>.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8bad831 e-flex e-con-boxed e-con e-parent\" data-id=\"8bad831\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7d32bf2 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"7d32bf2\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.22.0 - 17-06-2024 *\/\n.elementor-widget-divider{--divider-border-style:none;--divider-border-width:1px;--divider-color:#0c0d0e;--divider-icon-size:20px;--divider-element-spacing:10px;--divider-pattern-height:24px;--divider-pattern-size:20px;--divider-pattern-url:none;--divider-pattern-repeat:repeat-x}.elementor-widget-divider .elementor-divider{display:flex}.elementor-widget-divider .elementor-divider__text{font-size:15px;line-height:1;max-width:95%}.elementor-widget-divider .elementor-divider__element{margin:0 var(--divider-element-spacing);flex-shrink:0}.elementor-widget-divider .elementor-icon{font-size:var(--divider-icon-size)}.elementor-widget-divider .elementor-divider-separator{display:flex;margin:0;direction:ltr}.elementor-widget-divider--view-line_icon .elementor-divider-separator,.elementor-widget-divider--view-line_text .elementor-divider-separator{align-items:center}.elementor-widget-divider--view-line_icon .elementor-divider-separator:after,.elementor-widget-divider--view-line_icon .elementor-divider-separator:before,.elementor-widget-divider--view-line_text .elementor-divider-separator:after,.elementor-widget-divider--view-line_text .elementor-divider-separator:before{display:block;content:\"\";border-block-end:0;flex-grow:1;border-block-start:var(--divider-border-width) var(--divider-border-style) var(--divider-color)}.elementor-widget-divider--element-align-left .elementor-divider .elementor-divider-separator>.elementor-divider__svg:first-of-type{flex-grow:0;flex-shrink:100}.elementor-widget-divider--element-align-left .elementor-divider-separator:before{content:none}.elementor-widget-divider--element-align-left .elementor-divider__element{margin-left:0}.elementor-widget-divider--element-align-right .elementor-divider .elementor-divider-separator>.elementor-divider__svg:last-of-type{flex-grow:0;flex-shrink:100}.elementor-widget-divider--element-align-right .elementor-divider-separator:after{content:none}.elementor-widget-divider--element-align-right .elementor-divider__element{margin-right:0}.elementor-widget-divider--element-align-start .elementor-divider .elementor-divider-separator>.elementor-divider__svg:first-of-type{flex-grow:0;flex-shrink:100}.elementor-widget-divider--element-align-start .elementor-divider-separator:before{content:none}.elementor-widget-divider--element-align-start .elementor-divider__element{margin-inline-start:0}.elementor-widget-divider--element-align-end .elementor-divider .elementor-divider-separator>.elementor-divider__svg:last-of-type{flex-grow:0;flex-shrink:100}.elementor-widget-divider--element-align-end .elementor-divider-separator:after{content:none}.elementor-widget-divider--element-align-end .elementor-divider__element{margin-inline-end:0}.elementor-widget-divider:not(.elementor-widget-divider--view-line_text):not(.elementor-widget-divider--view-line_icon) .elementor-divider-separator{border-block-start:var(--divider-border-width) var(--divider-border-style) var(--divider-color)}.elementor-widget-divider--separator-type-pattern{--divider-border-style:none}.elementor-widget-divider--separator-type-pattern.elementor-widget-divider--view-line .elementor-divider-separator,.elementor-widget-divider--separator-type-pattern:not(.elementor-widget-divider--view-line) .elementor-divider-separator:after,.elementor-widget-divider--separator-type-pattern:not(.elementor-widget-divider--view-line) .elementor-divider-separator:before,.elementor-widget-divider--separator-type-pattern:not([class*=elementor-widget-divider--view]) .elementor-divider-separator{width:100%;min-height:var(--divider-pattern-height);-webkit-mask-size:var(--divider-pattern-size) 100%;mask-size:var(--divider-pattern-size) 100%;-webkit-mask-repeat:var(--divider-pattern-repeat);mask-repeat:var(--divider-pattern-repeat);background-color:var(--divider-color);-webkit-mask-image:var(--divider-pattern-url);mask-image:var(--divider-pattern-url)}.elementor-widget-divider--no-spacing{--divider-pattern-size:auto}.elementor-widget-divider--bg-round{--divider-pattern-repeat:round}.rtl .elementor-widget-divider .elementor-divider__text{direction:rtl}.e-con-inner>.elementor-widget-divider,.e-con>.elementor-widget-divider{width:var(--container-widget-width,100%);--flex-grow:var(--container-widget-flex-grow)}<\/style>\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4b48507 e-flex e-con-boxed e-con e-parent\" data-id=\"4b48507\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-353926e e-con-full e-flex e-con e-child\" data-id=\"353926e\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-083406e elementor-widget elementor-widget-image\" data-id=\"083406e\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/website-compromise.webp\" class=\"attachment-large size-large wp-image-9765\" alt=\"Website Compromise\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47ac9cf e-con-full e-flex e-con e-child\" data-id=\"47ac9cf\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-73dbf27 elementor-widget elementor-widget-heading\" data-id=\"73dbf27\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Web site compromise<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f3f98d8 elementor-widget elementor-widget-text-editor\" data-id=\"f3f98d8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>QCC were contacted by a payment processing company and asked to investigate the possible compromise of a web server of a large travel firm. Liaising with the system administrators, QCC technicians were able to forensically gather logs, memory and disk images of the server. QCC analysts were quickly able to identify how the server was compromised, what had been taken and make recommendations to prevent repeated loss of customer data.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b605ce6 e-flex e-con-boxed e-con e-parent\" data-id=\"b605ce6\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-524f3d1 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"524f3d1\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b12b71f e-flex e-con-boxed e-con e-parent\" data-id=\"b12b71f\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-a3cb8c1 e-con-full e-flex e-con e-child\" data-id=\"a3cb8c1\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b78eab4 elementor-widget elementor-widget-image\" data-id=\"b78eab4\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/malware-infection-of-servers.webp\" class=\"attachment-large size-large wp-image-9761\" alt=\"Malware Infection Of Servers\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-74ae3cc e-con-full e-flex e-con e-child\" data-id=\"74ae3cc\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f290fe6 elementor-widget elementor-widget-heading\" data-id=\"f290fe6\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Malware infection of servers hosted in Swiss datacentre\t\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7509e7e elementor-widget elementor-widget-text-editor\" data-id=\"7509e7e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>QCC were contacted by a Client concerned about the suspected infection of critical servers, based in a datacentre in Switzerland. QCC were able to despatch analysts quickly to the site to perform analysis on the servers. Being located in Switzerland, various local data protection issues had to be addressed and complied with by QCC staff. The servers, running an old version of Red Hat LINUX could not be taken off-line and were configured with significant amounts of attached storage. QCC analysts performed a memory dump on the devices and were able to identify a number of suspicious processes running on the devices. Further analysis back at the QCC labs, enabled the analysts to determine the capabilities of the malware and determine how long it had been operating. QCC advised on the removal of the malware and on the implementation of controls which protect the systems from further cyber breaches.<\/p>\n<p><strong><a href=\"https:\/\/www.qccglobal.com\/contact-us\/\">Contact us<\/a><\/strong>\u00a0for further advice or return to\u00a0<strong><a href=\"https:\/\/www.qccglobal.com\/digital-forensics\/\">digital forensics services page<\/a>.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4ebd9d9 e-flex e-con-boxed e-con e-parent\" data-id=\"4ebd9d9\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-cecf05b elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"cecf05b\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b18f4c7 e-flex e-con-boxed e-con e-parent\" data-id=\"b18f4c7\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-48a8517 e-con-full e-flex e-con e-child\" data-id=\"48a8517\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2fd3e3a elementor-widget elementor-widget-image\" data-id=\"2fd3e3a\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/malware-infection-on-ceo-s-laptop.webp\" class=\"attachment-large size-large wp-image-9763\" alt=\"Malware Infection On CEOs Laptop\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-edeeb71 e-con-full e-flex e-con e-child\" data-id=\"edeeb71\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f6c6b06 elementor-widget elementor-widget-heading\" data-id=\"f6c6b06\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Suspected malware infection on CEO\u2019s laptop<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1f7ada0 elementor-widget elementor-widget-text-editor\" data-id=\"1f7ada0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>A CEO had recently travelled to the Far East and was concerned that her laptop may have been compromised by foreign intelligence actors. Using advanced forensic techniques and technical knowledge, QCC forensic experts were able to analyse the laptop and communications traffic from the device and determine that the laptop had indeed been infected with malware. The CEO\u2019s mobile phone was also forensically examined and found to be compromised with spyware. QCC cleaned the devices of all malware and spyware and provided security procedures and training to the Client for any further visits to overseas countries.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da44d09 e-flex e-con-boxed e-con e-parent\" data-id=\"da44d09\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-80cf812 elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"80cf812\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-041a230 e-flex e-con-boxed e-con e-parent\" data-id=\"041a230\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-90a792e e-con-full e-flex e-con e-child\" data-id=\"90a792e\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ea16e8f elementor-widget elementor-widget-image\" data-id=\"ea16e8f\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/digital-forensics-raid-reconstruction.webp\" class=\"attachment-large size-large wp-image-9755\" alt=\"Digital Forensics Raid Reconstruction\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6aaf562 e-con-full e-flex e-con e-child\" data-id=\"6aaf562\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d48130a elementor-widget elementor-widget-heading\" data-id=\"d48130a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">RAID reconstruction\t\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ce6aa4 elementor-widget elementor-widget-text-editor\" data-id=\"9ce6aa4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>A Government agency had visited a company as part of an investigation. Unfortunately, while on site the government imaging technician had imaged the company\u2019s file server\u2019s RAID storage a disk at a time and on return to their forensics laboratory was unable to reconstruct the RAID device for forensic analysis. QCC experts were asked to assist and using advanced forensic tools, were eventually able to produce an image of the raid server for analysis.<\/p>\n<p><strong><a href=\"https:\/\/www.qccglobal.com\/contact-us\/\">Contact us<\/a><\/strong>\u00a0for further advice or return to\u00a0<strong><a href=\"https:\/\/www.qccglobal.com\/digital-forensics\/\">digital forensics services page<\/a>.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3ac7fc1 e-flex e-con-boxed e-con e-parent\" data-id=\"3ac7fc1\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f899c8a elementor-widget-divider--view-line elementor-widget elementor-widget-divider\" data-id=\"f899c8a\" data-element_type=\"widget\" data-widget_type=\"divider.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-divider\">\n\t\t\t<span class=\"elementor-divider-separator\">\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f29e96f e-flex e-con-boxed e-con e-parent\" data-id=\"f29e96f\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-06baf2c e-con-full e-flex e-con e-child\" data-id=\"06baf2c\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-39ab353 elementor-widget elementor-widget-image\" data-id=\"39ab353\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"300\" height=\"300\" src=\"https:\/\/qccglobal.com\/wp-content\/uploads\/2024\/05\/government-forensics.webp\" class=\"attachment-large size-large wp-image-9759\" alt=\"Government Forensics\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6a0024f e-con-full e-flex e-con e-child\" data-id=\"6a0024f\" data-element_type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-523bea0 elementor-widget elementor-widget-heading\" data-id=\"523bea0\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Government enquiry\t<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d6c9d5d elementor-widget elementor-widget-text-editor\" data-id=\"d6c9d5d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>A long running Government enquiry was concerned that a computer, used in the enquiry may have been tampered with by an external actor. QCC digital forensics investigators were asked to travel to the enquiry offices covertly and acquire a forensic image of the computer and attempt to determine if the device had been accessed during a specific period in time. On arrival, it was found that the hard drive of the computer had failed and the drive was seized and returned for data recovery. QCC recovered the data and were then able to prove that the computer had been accessed in the time period in question.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9ebda82 e-flex e-con-boxed e-con e-parent\" data-id=\"9ebda82\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-40a4f2e elementor-widget elementor-widget-spacer\" data-id=\"40a4f2e\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Employee theft of customer information QCC received a call from the worried CEO of a company whose business involved leasing high value items to private individuals. He suspected that his sales director was planning on leaving the company with a copy of the customer database to join a rival start up business. QCC were able [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"acf":[],"_links":{"self":[{"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/pages\/3779"}],"collection":[{"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/comments?post=3779"}],"version-history":[{"count":10,"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/pages\/3779\/revisions"}],"predecessor-version":[{"id":13057,"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/pages\/3779\/revisions\/13057"}],"wp:attachment":[{"href":"https:\/\/qccglobal.com\/wp-json\/wp\/v2\/media?parent=3779"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}