Digital forensics

Millnet offers an extensive range of digital forensic services with expertise in both civil and criminal matters. The experienced and certified Millnet team have provided expert witness services across many jurisdictions and deliver quality investigation services across the globe in a range of areas including but not limited to fraud, data theft and compromise, abuse of computer policies, malware, metadata and criminal offences. Our expertise covers computers, servers, mobile devices and cloud and we pride ourselves on providing cutting edge solutions in particular in prominent and emerging technologies like Mac and tablets including the iPad.

We offer leading forensic collection services to support electronic disclosure and large corporate investigations. This includes remote and network level forensic imaging and also solutions to assist with data triages.


Forensic Services Capabilities

The Millnet forensic team are experienced at collecting in the field and have developed solutions to deal with the forensic collection from a variety of different data sources. What follows is a list of common sources of data we are asked to and are capable of collecting data from. It should be noted that by this is by no means an exhaustive list and our team should be consulted when anything not listed is identified.

  • Laptops / Desktops
  • Windows / Mac / Linux / Android
  • Mobile devices & tablets
  • GPS & digital camera
  • CD / DVD
  • Servers including virtual servers
  • Webmail (Gmail, Yahoo etc)
  • SharePoint
  • Database systems
  • Tape archives

Ensuring forensic capture of electronic data is achievable and without issue is critical. As a consequence we have focused on providing a range of imaging solutions, which allow for concurrent, remote and also ‘hands off’ data collections. Where circumstance permits our options around concurrent image are strong and our limiting factor, which is not insurmountable becomes the amount of storage available to write forensic images to. In short, we place or boot each computer to be imaged into a forensic environment and write full forensic images to an external device like a USB. Given the manpower and suitable storage it is possible to image 50 devices concurrently.

Remote and ‘hands off’ forensic collections are increasingly necessary to ensure costs are proportionate. No longer does a forensic consultant need to fly around the world incurring significant costs to collect data from a single computer. One solution is to deliver a small forensic utility via the Millnet portal across the Internet and using solutions like WebEx or GoToMyPC remote into target system to conduct a live forensic image. Alternatively, we can take a ‘hands off’ approach. This involves our forensic team creating and pre-configuring a very simple utility and sending it to the remote location on a USB device.

Upon receiving the device containing the imaging utility the user connects the device to the target item and clicks go to start the imaging process. Because our team configure the device initially, it understands what to image and how to image it.

For further information about the ‘best of breed’ technology used by our digital forensics team please visit who we are/technology partners.


Backup Tapes

Historical data files are often locked away in offline tapes in proprietary backup formats. As a result, retrieving data from these tapes is extremely time consuming and costly, requiring the entire backup tape to be restored to disk before it can be searched. 

Millnet’s backup tape solution automates the process of searching and extracting data from offline tapes. Offline tapes are directly indexed without restoring or copying, and the data is immediately searchable. Users can quickly find what they need, restoring only relevant files and email, rather than restoring the entire tape contents. Index Engines provides a unified enterprise-wide index of backup tape data at unmatched speed, scale and value.

Using Millnet’s approach to backup tapes, the need to recreate the original environment, or restore the volume of data is eliminated. We start our process by cataloging and indexing the tapes which is the equivalent of reading each tape once. Even if the tapes are multi-streamed, access to the data is much faster than traditional restoration.  There is no additional storage space required beyond that required to hold the index segments we create (included with our processing, on our appliance) and to hold the responsive data that gets extracted in the end – typically a small subset of the mass volume on the tapes.

Cull, search and de-duplicate content prior to extracting any data from tapes. The indexing process includes full content and metadata indexing of all supported files on the tapes and will drill down as many levels as necessary, for example into EDB’s and NSF files, PST’s, and file system data. During the indexing process, a series of index segments are created that are completely searchable and reportable. We index the data as it resides on tape, run the hash values of the files, de-duplicate and deNIST (remove all known system files as per the current NSRL database) during this process.

Once the index has been created, the data can be searched through a web based interface that can be used internally or hosted for a client to access and search the data. This process results in only responsive data being tagged, and ultimately extracted from the tapes.

Extremely scalable, cost effective tape processing. The processes detailed above take a fraction of the time associated with the Restoration process, and are all done without a replica infrastructure. By eliminating the overhead in the data stream, we enable customers to rapidly and comprehensively process data, and quickly identify which information is relevant and what can be disregarded, thereby streamlining the review process and ensuring the most critical data is recovered. There is no other solution that can index and process high volume of tape data more efficiently or cost effectively.



Millnet operates the largest independent reprographics facility in London. Services offered include photocopying, scanning and coding of documents. We are able to filter, extract and print data from electronic media plus we offer a range of sophisticated database services to support legal sector clients in all types of cases.

We are technically advanced, efficient and champion flexibility and contingency plans as part of our operating structure to cater for the unforeseen. Above all, security and confidentiality are fundamental to the services we provide. We operate 24/7 and our structure is geared to deliver services at speed, both night and day. Most importantly, the calibre of our staff and their development is key to the consistent achievement of high level quality.

  • Contact

    Contact Us

  • Approved Infrastructure