Digital forensics & expert witness
Answers that hold up. In court, before a regulator, anywhere.
When the question is what actually happened, opinion isn’t good enough. We collect, preserve and analyse digital evidence to a standard that survives cross-examination: chain of custody kept, method documented, findings written so a judge, regulator or board can rely on them. Engaged directly or through counsel.
Evidence degrades and devices get reimaged. If a matter is unfolding, call before anyone “tidies up”. We’ll tell you what to preserve on that first call, at no charge.
What we investigate.
- Forensic investigation of systems, cloud, mobile and networks
- Insider threat and employee misconduct → insider investigations
- Data theft and IP exfiltration
- eDiscovery
- Post-incident inspection
- Compromise assessment
- Expert witness and expert reports
- Chain of custody and evidence handling
Forensics is not a marketing word here.
Examinations are conducted with documented, repeatable method by certified examiners: CFCE (IACIS), GCFA, GNFA and GASF (GIAC), X-PERT (X-Ways). Our consultants sit on the GIAC Advisory Board and Ethics Council. Independence is the product: we have no stake in what the evidence says, and our reports read that way.
For counsel.
We work to instructions, produce reports fit for proceedings, and give evidence when required. Litigation support across civil, criminal, regulatory and employment matters. Statutory developments, including the Privacy Act’s statutory tort, are widening what clients may need proven; we’re built for that standard of proof.
When it’s someone inside.
Departing staff with a USB habit. Privileged access used after hours. A tip-off you can’t unhear. Insider matters are legally and personally delicate: employment law, privacy obligations and procedural fairness all constrain what you can do, and clumsy first moves destroy both evidence and cases. Engage us early, usually alongside counsel and HR.
Building the programme that prevents this? Insider risk management →
Asked by clients and counsel alike.
Can you just take a quick look at a laptop?
We can, but “a quick look” is how evidence becomes inadmissible. Tell us the situation first; the right first step is usually preservation, and it’s fast.
Do you do fixed fees?
For defined scopes, yes. Ongoing matters are estimated in writing and re-confirmed as scope evolves. Pricing principles apply.
Are your findings usable with insurers?
Yes. Forensic method is exactly what insurers and their panels need for a clean claim.
Preserve first. Decide second.
Call before anything gets tidied up. First-call preservation guidance is free.