What may be examined
Windows computers
File-system metadata, application records, event logs and traces of connected storage may help establish a sequence. A USB connection record alone does not prove which files were copied.
Mac computers
APFS volumes, available snapshots, application databases and system records can provide different views of activity. FileVault access and the Mac’s security state determine which collection methods are possible.
Linux and workstations
Relevant material can include user directories, available journals, authentication records and application-specific logs. Configuration, log rotation and prior maintenance affect what remains.
Before an examination
Record the make, model, current power state and relevant dates without opening files to investigate them. Do not reinstall the operating system, run cleanup utilities or attempt repeated password guesses. Ask for handling instructions before changing power or network state.
What you can receive
The agreed deliverable can include an acquisition record, hashes for preserved data, a timeline with time-zone notes, selected artefacts and an explanation of alternative interpretations. A copy of a drive does not by itself answer the investigation question.
What the evidence may not establish
Encryption, overwritten data, unavailable credentials and incomplete logs may restrict the examination. A file timestamp does not necessarily identify the person who caused an event.
Questions before you begin
Sometimes. The storage, encryption and hardware condition determine the options. Repair needed to access data is scoped separately, with changes documented before evidence is altered.
Recovery seeks usable files. Forensic work also documents how material was obtained, handled and interpreted. Tell us about a dispute before authorising repairs or recovery.