Digital Forensics
Analyze digital records to establish what happened and clarify the facts.
Our approach
When information leakage or a security incident occurs, organizations need evidence of when data was accessed, what actions took place and where the data moved.
LnJ Tech collects and analyzes digital records from computers, storage media, business systems and mobile devices, then connects the relevant findings. We provide technical analysis for security incidents, internal information leakage, corporate internal audits and software similarity reviews.
Examining storage media and related records to trace the movement of digital information.
Service scope
Security incident analysis
Analyze records from computers, servers and business systems to understand how an incident occurred and its impact. Review account activity, system events and security logs in chronological order to identify signs of compromise and related actions.
- Analyze the incident timeline and related system activity
- Examine links between account access and suspicious actions
- Review data access, movement traces and the affected scope
- Report the incident sequence and analysis findings
Internal information leakage and misconduct analysis
Examine suspected access, copying, deletion or external transfer of important documents and business data. Review email, business-system records and storage-media activity to support fact-finding, internal audits and technical reviews for mergers and acquisitions.
- Analyze traces of access, copying and deletion of important data
- Review possible transfers through removable media and email
- Correlate documents and business records over time
- Prepare analysis materials for internal audits and due diligence
Software copying and similarity analysis
Compare source code and related digital materials to identify matching sections and structural similarities. Define the comparison scope and criteria, and provide technical findings for assessing possible software copying.
- Analyze matching sections and similarities in source code
- Compare code structures and components
- Prepare a technical report describing methods and comparison results
Consolidated review of large digital datasets
Organize data distributed across devices and business systems into a searchable, reviewable form. Identify duplicates and enable searches across documents, email and images to help reviewers find relevant information.
- Extract and consolidate digital data in different formats
- Identify duplicates and create search indexes
- Extract text from image documents using OCR
- Search keywords and examine relationships between records
- Classify review materials and organize the findings
Analysis sources and services
- Computers and storage media
- Collection and imaging of data from PCs, laptops, USB devices and hard disks, with deletion-trace analysis and recovery feasibility review
- Corporate business systems
- Data extraction and record analysis for electronic approval systems, email and databases
- Mobile devices and messaging data
- Extraction and analysis of mobile-device and KakaoTalk PC data, with an assessment of recoverable conversation records
- Large document and email datasets
- Consolidation, deduplication, indexing and keyword searches to review relevant information
Extraction and recovery scope is determined after reviewing the device, operating system, app version and the state of deleted or encrypted data.
Our process
STEP 01
Confirm objectives and scope
Review the situation and questions to be answered, then agree on the analysis targets, authorization to provide data and scope of work.
STEP 02
Collect and preserve data
Collect the agreed materials and create forensic images where needed. Manage data integrity through hash verification and collection records.
STEP 03
Analyze digital records
Examine files, system records, email and messaging data. Correlate events and records over time to clarify relevant actions and circumstances.
STEP 04
Report the findings
Distinguish established facts from analytical inferences. Explain the supporting evidence and limitations, and provide materials for follow-up action.
Frequently asked questions
When can digital forensics help?
It can clarify incident sequences and data movement after security incidents or suspected internal information leakage. Technical analysis for internal audits or software similarity reviews is scoped to the questions to be answered.
What devices and data can be analyzed?
Potential sources include PCs, storage media, business systems and mobile-device records. Collection and analysis scope is determined after checking authorization to provide the data and the condition of the devices and records.
Can deleted files or conversation records be recovered?
Recovery depends on factors such as deletion, encryption and the device environment. We examine the materials before assessing the possible extraction and recovery scope.
What does the analysis report contain?
We organize timelines, relationships between records, established facts and supporting findings. The report distinguishes confirmed facts from analytical inferences and explains the limitations.
The scope of work and deliverables are determined by the target environment and the agreed engagement.
Need to understand what your digital records show?
Discuss an analysis scope suited to suspected information leakage, a security incident, an internal audit or a software similarity review.