Digital Forensics
Digital Forensics — Device and Account Evidence
We preserve and analyze evidence on smartphones, PCs and cloud accounts, at the request of the device or account owner, or under legal process through counsel or law enforcement. As part of incident response, this work establishes how a data leak or account takeover happened and preserves records for legal action.
We do not examine third-party devices without the owner's consent, and we do not track the location or communications of third parties.
Scope
What we take on
01 / Corporate Devices
Company-owned devices and accounts
Traces of unauthorized access, data exfiltration and malware infection on devices and accounts the company manages. Examination of devices used by departed employees follows internal policy and procedure.
02 / Personal Devices (Owner's Request)
Your own devices and accounts
When your device or social-media account may have been taken over, impersonated or monitored, we identify the intrusion path and scope and help you lock it down.
03 / Evidence Preservation
Preserving evidence for legal action
For police reports and litigation, we preserve device state, communication records and screen captures with hashes and chain-of-custody records, ready to hand to counsel or law enforcement. Recovery of deleted data is limited to the owner's own devices and company assets.
04 / Reporting
Reporting and prevention
A report covering the timeline, intrusion path, scope of impact, recovery and prevention. Where a law-enforcement referral or legal action is needed, we proceed together with our retained legal counsel.
Process
How an engagement runs
- 1. Intake and eligibility — ownership of the device or account, internal policy, and any legal process are confirmed.
- 2. Preservation — the device or account is imaged and recorded without altering it; hashes and custody records are created.
- 3. Analysis — logs, communication records and application traces establish the intrusion path, timing and scope.
- 4. Reporting — a report separating facts from assessments, with prevention measures.
- 5. Legal support — materials prepared for counsel or law enforcement as required.