Frequently asked questions

It is a technical document that analyses digital evidence and sets out the conclusions so that a court can weigh them. It is usually needed when one of the parties submits digital evidence — emails, messages, access logs, files, metadata — and its authenticity, its integrity or what it actually proves has to be established.

On its own it is weak evidence: a screenshot is trivial to fake and proves neither where the message came from nor that it has not been altered. What carries evidential weight is the analysis of the device the conversation comes from, which allows the content to be verified inside the application database and the way it was obtained to be documented. If screenshots are all you have, tell me anyway — in some cases the original source can still be reached.

For an initial assessment, a general description of the case is enough: what happened, what you need to prove, what material exists and what deadlines the proceedings are under. Nothing else needs to be sent at that first stage, and it is better not to.

Preferably not. Continuing to use the device, restarting it, installing recovery tools or trying to restore deleted files can overwrite the very evidence that matters, and it leaves traces the opposing party can use to challenge the evidence. The most useful thing you can do is leave it as it is and ask before touching anything.

Never through the form on this website. Once we are in touch, we agree how the handover will take place and it is documented in a record stating what is handed over, in what condition and when. From that point on, the analysis is always carried out on a forensic copy verified with a cryptographic hash, never on the original media.

It depends on the scope: verifying the authenticity of a conversation is not the same as analysing a compromised server. When you get in touch I will send you my rates and, once I have a description of the case, a fixed quote before any work begins.

It depends on the volume of material and the type of analysis. The deadline is agreed when the engagement is accepted. If the proceedings have a cut-off date, say so in your first message: it directly shapes how much can realistically be done.

They are delivered all the same. An expert report is only worth anything if it is independent and if the opposing party can reproduce and verify the method used; tailoring the conclusions to whoever commissioned the work invalidates it, and it gets noticed. If something that weakens your position comes up during the analysis, I will tell you before writing the report so you can decide how to proceed.

It is the appearance in court to explain and defend the report before the judge and the parties. It is not always requested, but it is worth planning for from the outset: a report whose author cannot ratify it carries less weight. It is quoted separately from the report itself.

With both, and with companies as well in the case of incident response. Every case is handled under a confidentiality agreement, regardless of who commissions the work.