Email - sam@raincock.co.uk     Call -  01434 600635

 Computer Forensics

In the computing forensics field, Sam Raincock Consultancy specialises in evaluating the evidence on anything from a memory card to a corporate server.   Expert assessments (opinion based evidence) are made to determine the reason why and the circumstances surround how certain data is present on a device.   Assessments can also be made with respect to attribution of usage evidence.    Sam specialises in cases involving the presence of alleged illegal material including indecent images of children (IIoC), extreme imagery, prohibited imagery and evidence associated with terrorism offences (including possession of articles).   She can also combine cases which involve both telephone handsets and computers.


SRC also take instructions in complex fraud evidence and other matters involving complex technical usage/defences and/or network forensics (including logged IP address usage in logs/intelligence etc.).  This includes cases involving withholding of passwords, interpretation of snippets of data, evaluating cases involving spoofing, hacking, virus and Trojan allegations/defences, reviewing data that forensic software is unable/deficient in its ability to interpret, and commenting on the validity of intricate/technical defences/use.

Windows, Unix, Linux and Macs including server based systems



After a period of training Sam started taking instructions and authoring computer reports over 16 years ago meaning she has a large range of experience of different operating systems and changes in computing over this time period.   She is able to forensically examine different types of computer systems including Apple Macs, Windows, Unix and Linux. Examinations of servers or information extracted from servers can also be performed.   


SRC has access to the latest forensic software and has current licences for the use of Axiom, X-Ways Forensics, Forensic Explorer (including Live View), and Intella as well as other packages.  She can also manually review databases, and write computer programs where required to process data/use that may not be provided via commercial software.    She can also validate the data present in your case to ensure the evidence presented is accurate and complete with the limitations fully explored.


Sam is a specialist in all things digital meaning she can also combine computer forensics with other types of data including from a phone handsets/tablets (including as backups on computers/devices), cell site analysis, network forensics and/or location/vehicle data. Sam able to act as a single case expert in such cases requiring a combination of evidence.


SRC specialises in forensics, SRC does not provide data recovery services and instead Sam provides opinion based evidence.  Typically an instruction is 40+ hours of work, although if involving the North East police forces, and where Sam is available, she may be able to undertake a smaller instruction (with a minimum time of 25 hours). Sam may also be able to combine travel in cases to reduce costs and make smaller instructions more available.


Bespoke Testing/Evaluations


SRC can also test and consider how applications work in very specific circumstances (including for bespoke systems) and comparing this to the evidence present within cases as well as evaluating the policies and procedures of an organisation. In the past this has involved Sam testing/reviewing of bespoke hospital, tax, military, police and large organisations systems and security procedures.


Sam also takes instructions for a range of digital evidence cases involving ‘bespoke’ investigations requiring novel solutions which may not be achievable using commercial forensic software. 


Obtaining Access to Data


SRC does not supply generic/theoretical statements in cases since digitally the possibilities are endless - it is necessary to obtain access to the data in case.   In computer cases this usually requires a set process of Sam liaising directly with the digital forensic units to obtain copies of the computers and other digital devices (including 'downloads' of telephone handsets) when the required permissions are in place.   SRC can assist with obtaining the required data disclosure in digital evidence cases including providing you with the correct technical wording for your disclosure request and to manage the disclosure of data from the CPS/police/CTU or digital forensic unit (including signing required MOUs) and organising collection. 


Since 2nd October 2023, computer forensics requires Compliance with the Code of Practice from the Forensic Regulator.    SRC is currently non-compliant and does not have ISO17025 accreditation.   A full discussion of the implications of this will be provided with you prior to instruction, and where the instruction is accepted, the required non-compliance declarations made.


In order for SRC to assess what is required in your criminal case it is useful if you can initially provide the following:


  1. Trial date (including schedule time) and any Court or other deadlines.
  2. Statements and reports in relation to the technical evidence and seized digital devices.
  3. MG5 or case bundle.
  4. Details of defence or defence statement.
  5. Any specific instructions you have and/or Counsel's advice.


Sam is primarily a criminal practitioner.   She does take on a limited number of other matters particularly if they involve the investigation of a death or involve children.  Please provide details of your case when initially contacting.   Note that for any case it will be essential that you ascertain written permission for access to the devices and data in full (for handsets/computers this will be everything stored including possibly deleted data) since without this SRC will be unable to progress the case.   You will need where possible to establish what the computers are, if they are encrypted, what disks (and sizes) are involved etc.   Please also provide details of any case deadlines or otherwise.


Sam and has acted as an experienced expert in a range of computer, security and software evaluation cases - see casework list for a sample list of previous cases.

Share by: