Evidence · incident · litigation

Digital forensics for sensitive matters, internal incidents and defensible decisions.

This path is built for organizations, firms and mandating parties that need properly preserved digital evidence, a credible chronology and a deliverable that can be used by leadership, counsel, insurers or non-technical stakeholders.

CFE Chain of custody Structured reporting

When this offer fits

  • Internal incident, suspected fraud, contested departure or suspicious workstation behaviour.
  • Ransomware, compromise, suspected exfiltration or the need to preserve before review.
  • Civil, criminal, disciplinary or insurance matters that require structured digital evidence.
  • Mandates where chain of custody matters as much as extraction itself.

What the lab protects

Media integrity, handling traceability, the readability of the timeline and the ability of the report to be used in a business decision or legal context. The goal is not technical theatre. It is usable evidence.

What you get

  • Preservation — acquisition and copying under a documented protocol, with hashes and chain logging.
  • Analysis — timeline reconstruction, targeted extraction and artifact correlation aligned to the mandate.
  • Report — a structured deliverable for leadership, counsel, insurers or partner experts.
  • Clear exchange — one accountable contact who can explain findings without hiding behind jargon.

What to avoid before engaging us

  • Continuing to use the compromised system or touching accounts without proper logging.
  • Overwriting evidence through sync, updates, reboots or poorly controlled exports.
  • Mixing recovery goals and evidence goals without a clearly defined mandate.
  • Running an undocumented internal investigation when litigation or insurance escalation may follow.

Mandate format

Three levels based on exposure and scrutiny

Cost and timing depend on data volume, number of media, analysis depth and the legal or organizational sensitivity of the matter.

Initial brief

Mandate qualification

By call

Validation of context, media, immediate preservation steps and mandate logic before any formal engagement begins.

Targeted analysis

Operational forensics

$500+

For preservation, acquisition, incident reading and structured reporting in a business or sensitive-case context.

Expert mandate

Litigation-grade matter

Quoted

For judicial matters, insurance exposure, multiple media, firm coordination or cases that may require expert appearance.

Trust proof

What makes the mandate defensible

Sensitive matters are won on method as much as outcome. These proof points reduce risk for leadership, counsel and insurers.

Qualification

Certified Forensic Examiner

International digital forensic qualification, with experience preparing expert reports and testimony.

Traceability

Documented chain of custody

Intake log, timestamps, hashes, documented handling and controlled return of media or extracted data.

Insurance

Professional liability E&O

Active coverage for technical and forensic mandates, useful when the matter involves a third party or formal decision.

Confidentiality

Law 25 handling and controlled destruction

Minimal collection, restricted access, encrypted transfer and limited retention according to mandate scope and client instructions.

Speak with the examiner Enterprise engagements The lab

Frequently asked questions

Digital forensics

What is forensic chain of custody?

It is the documented process that guarantees no data was altered from the moment of acquisition through to delivery of the report. Every step is logged, timestamped and signed.

Is the evidence admissible in court?

Acquisition and analysis follow recognized standards (NIST, SWGDE). Admissibility always depends on the legal context and the court's decision, but the technical rigour is in place.

Should I shut down the system immediately?

In most cases, yes. Continuing to use a compromised or failing system can overwrite valuable data. Contact us before taking any action.

Who can engage forensic services?

Law firms, corporations, insurers, internal IT teams, court-appointed experts and individuals with a sensitive matter. A confidentiality agreement is available.

How long does forensic analysis take?

Common logical cases can take 2 to 5 business days. Complex incidents (ransomware, multi-disk NAS, mobile) typically require 5 to 15 days. An indicative timeline is provided in the quote.