INDEPENDENT DIGITAL FORENSICS · CYPRUS

Digital evidence.
Clear answers.

When the facts matter, the details matter. Independent examination of digital evidence, clear reporting and expert testimony.

Chat on WhatsApp Explore our expertise

For lawyers, businesses & individuals.Preserve the source. Understand the evidence.

Documented handlingEvidence-led analysisIndependent reporting

OUR EXPERTISE

Complex evidence.
A clear way forward.

Every matter starts with a question. We identify the relevant digital sources, examine what they contain and explain what the findings support.

01CRIMINAL DEFENCE

Digital Forensics for Criminal Defence

Independent examination of digital evidence and technical scrutiny of the prosecution’s material.

Read the full serviceClose service details

If you are a defendant in a criminal case, ISS can examine all available digital evidence relevant to your case and within the agreed scope of examination. This may include data from mobile phones, computers, tablets, CCTV systems, communication records, cloud services and electronic documents.

We independently review the digital evidence, technical reports and conclusions of the police or prosecution. We cross-check relevant witness statements and allegations against the available electronic data, looking for technical weaknesses, ambiguities, errors, inconsistencies, omissions and alternative explanations that may be significant to your defence.

Working with your lawyer, we identify the relevant underlying data, forensic copies and extraction files and request that they be made available through lawful channels. We conduct an independent forensic examination, also investigating material that may not have been examined or brought to light in the original analysis and that may assist the defence.

Our findings are presented in a documented report and, where required, through expert evidence in court.

02CIVIL DISPUTES

Digital Forensics for Civil Disputes

Independent examination of digital evidence and technical support for parties in civil cases.

Read the full serviceClose service details

If you are a party to a civil case, ISS can examine the relevant digital evidence and assess whether the electronic data supports the claims made by the parties involved.

The examination may cover emails, messages, electronic documents, business records, data from computers and mobile devices, cloud services, CCTV recordings and other relevant digital evidence.

We cross-check the data against relevant witness statements, claims and technical reports. We examine questions of authenticity, integrity, completeness and chronological consistency, as well as indications of alteration, selective presentation or incorrect interpretation.

Working with your lawyer, we identify the underlying data and forensic copies needed for an independent examination and request that they be made available through lawful channels. We also examine relevant material that may have been overlooked, to clarify the facts of the dispute.

We provide a clear, documented report of our findings and expert evidence where required.

03SEARCH WARRANT SUPPORT

Technical Support During the Execution of a Search Warrant

Independent technical observation and documentation of digital evidence handling, in coordination with your lawyer.

Read the full serviceClose service details

When the police execute a search warrant involving electronic devices or digital data, ISS can provide on-site support from an independent digital forensic expert, in coordination with your lawyer and where our attendance and access are lawfully permitted.

To the extent that the relevant activities are observable or lawfully disclosed to us, we document initial device inspection, live-data collection, search terms and filters where used, copying or extraction methods, device identification and the recording of transfers. We assess the documented procedures against appropriate digital-forensic practices, taking account of the device’s condition and the circumstances. Our review addresses data preservation, examination coverage and the reliability of later findings.

We document our observations and inform your lawyer of matters that may require legal assessment, including proportionality, the scope authorised by the warrant and procedural safeguards. Where required, we prepare a technical note or report for subsequent review.

Our attendance and the scope of our support depend on the applicable legal framework and the lawful arrangements for the particular case.

Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.

04 — 09

Digital evidence examinations

From the original source to findings you can understand.

Computer & mobile forensics

Preserve the source. Examine the available data.

Authorised forensic acquisition, preservation and examination of computers, mobile devices and storage media. We extract relevant data and recover deleted material where technically possible, recording the methods used and the limits of the available evidence.

Devices · Forensic copies · Data recovery

Malware & exploit forensics

Assess suspected compromise and its relevance to the evidence.

Forensic examination of phones, computers and available email and cloud records for indications of malware, spyware, stalkerware, exploitation or unauthorised access. We correlate findings with disputed activity, including claims that malware was responsible. We assess what the evidence supports about timing and actions, distinguish potential capabilities from documented activity, and explain the limits of attributing actions to a person.

Malware & spyware · Exploitation traces · Email & cloud access

Messages & screenshots

Understand the conversation in context.

Examination of messages and screenshots against available original records. We assess chronology, context and completeness, distinguishing what is visible from what the source data can establish about origin and attribution.

Messages · Source records · Context

Electronic documents

Trace the available document history.

Examination of document metadata, versions and indications of editing or transfer. We correlate file properties with available device records and explain what can be established about changes, timing and authorship.

Documents · Metadata · Versions

CCTV & alarm systems

Reconstruct the sequence of events.

Preservation and examination of CCTV recordings, native exports and available alarm or monitoring logs. We assess recording continuity, clock differences and event sequences, correlating video with activation, arming, disarming and response records where available.

CCTV · Alarm logs · Event timelines

Websites & online evidence

Preserve content before it changes.

Documented capture and preservation of available websites, online publications, images and files. We record sources and collection times, preserve the collected material and compare it with supplied originals for use in disputes about published or reused content.

Websites · Online publications · Content comparison

10 — 11

Specialist investigations & independent review

Focused examination of the events, records and conclusions in dispute.

Corporate data transfer

Investigate what happened to company information.

Technical investigation of suspected copying, disclosure, retention or deletion of business information, including matters involving employees or former collaborators. We correlate file activity, external media and available company-system records to identify events supported by the evidence and explain their context.

Company data · Internal investigations · File transfers

Independent forensic report review

Test the basis of the conclusions.

Independent review of another forensic report, its methods, search coverage and evidential reasoning. We compare material findings with available source data, consider alternative explanations and identify unsupported conclusions or limitations.

Expert reports · Methods · Source support

THE APPROACH

A traceable process.
From source to finding.

A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.

01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.

A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.

ALEXIS MAVROS

Qualifications & certifications

MSc
Digital Investigations & Forensic Computing
University College Dublin, Ireland
CFCE
Certified Forensic Computer Examiner
The International Association of Computer Investigative Specialists (IACIS)

IN THE MEDIA

Articles and interviews

Articles, interviews and media coverage of Alexis Mavros's work.

29 Sep 2026Ο Φιλελεύθερος / PhilenewsArticleGreek

Ο ανεξάρτητος ειδικός ψηφιακής εγκληματολογίας και διευθυντής της ISS Forensics, Αλέξης Μαύρος, μίλησε στον «Φ» για τις προεκτάσεις της υπόθεσης Oxygen Forensics.

Παρέμβαση του Αλέξη Μαύρου στον «Φιλελεύθερο» για την υπόθεση Oxygen Forensics και τα ερωτήματα προς τις αρμόδιες κυπριακές αρχές.

Digital evidence.Clear answers.

Complex evidence.A clear way forward.

Digital Forensics for Criminal Defence

Digital Forensics for Civil Disputes

Technical Support During the Execution of a Search Warrant

Computer & mobile forensics

Malware & exploit forensics

Messages & screenshots

Electronic documents

CCTV & alarm systems

Websites & online evidence

Corporate data transfer

Independent forensic report review

A traceable process.From source to finding.

Define

Preserve

Examine

Explain

Qualifications & certifications

Digital Investigations & Forensic Computing

Certified Forensic Computer Examiner

Articles and interviews

Ο ανεξάρτητος ειδικός ψηφιακής εγκληματολογίας και διευθυντής της ISS Forensics, Αλέξης Μαύρος, μίλησε στον «Φ» για τις προεκτάσεις της υπόθεσης Oxygen Forensics.

Oxygen Forensics: Alexis Mavros comments on the Cyprus connections

Υπόθεση Μαζωνάκη: Η σημασία των καταγραφών των ιατρικών συσκευών και πώς μπορούν να συμβάλλουν στην αποκάλυψη της αλήθειας

«Γίνονταν και γίνονται παρακολουθήσεις στην Κύπρο»: Το «βαλιτσάκι» και άλλες δύο μέθοδοι που χρησιμοποιούνται – Τρόποι προστασίας (ηχητικό)

Παρακολουθήσεις κινητών: Πώς η τεχνολογία ανοίγει νέους δρόμους στην υποκλοπή δεδομένων

Οι βασικότερες μορφές παρακολούθησης - Τρόπος προστασίας πολιτών

Πρώην αστυνομικός για παρακολουθήσεις: Αστυνομικοί-ωτακουστές χωρίς δικαστικό διάταγμα

Philenews coverage of Alexis Mavros’s Alpha TV comments on surveillance

Πιστεύεις ότι παρακολουθούν το κινητό σου; Πώς το επιβεβαιώνεις και τι κάνεις για να προστατευτείς

«Ποιος έστειλε πραγματικά το email; Η απάντηση κρύβεται στα ψηφιακά ίχνη» του Αλέξη Μαύρου

Μπορεί κάποιος να εντοπίσει τον αποστολέα ενός απειλητικού email; Ειδικός απαντά (ΒΙΝΤΕΟ)

Ψεύτικα e-mail: Έτσι έστειλαν στην Αννίτα τα απειλητικά μηνύματα, πώς να τα αναγνωρίσετε

Όταν τα ψηφιακά ίχνη μιλούν πιο δυνατά από τους ισχυρισμούς

Υπόθεση Σάντυ: Η ακτινογραφία των ισχυρισμών και τα τέσσερα προβληματικά τεκμήρια

Υπόθεση Σάντυ: Τα τέσσερα χαρακτηριστικά «τεκμήρια» που κατέρριψε η δημοσιογραφική έρευνα

Το ένταλμα έρευνας και τα όρια της κρατικής εξουσίας στην ψηφιακή εποχή

Αποκάλυψη για το ηχητικό της άφιξης Σάντυ: Όλα όσα κατέρριψε η δημοσιογραφική έρευνα

«Έπαιζε στη γερμανική τηλεόραση!»: Επίθεση Δρουσιώτη στην Αστυνομία για το ηχητικό της «Σάντυ»

Αποκαλυπτικό: Ρεπορτάζ του 2019 η «αναγγελία» που ακούγεται στο ηχητικό της άφιξης Σάντυ στη Γερμανία

Υπόθεση «Σάντυ»: Αναζητούν διαδρομές μαύρου χρήματος, το τεκμήριο-κλειδί κι ο ρόλος του FBI

Cyprus Inform coverage of the background audio in the Sandy recording

Cyprus Mail reports on analysis of the Sandy audio clip

Υπόθεση «Σάντυ»: Γιατί η αστυνομία χρησιμοποίησε λέξεις-κλειδιά στον έλεγχο συσκευών;

Αλέξης Μαύρος: Τα fake sms δεν αντέχουν τον δικανικό έλεγχο

Fake SMS Messages Do Not Withstand Forensic Scrutiny

Υπόθεση Σάντυ: Στο μικροσκόπιο η γνησιότητα των ψηφιακών τεκμηρίων

Υπόθεση Σάντυ: Τι λένε ειδικοί για αυθεντικότητα τεκμηρίων και νομιμότητα

Οι δυνατότητες της ψηφιακής εγκληματολογίας και το ομιχλώδες τοπίο γύρω από την υπόθεση «Σάντυ»

Υπόθεση «Σάντυ»: Τα δύο περίεργα μηνύματα που εγείρουν ερωτηματικά

Ο Αλέξης Μαύρος για την αυθεντικότητα μηνυμάτων και στοιχείων | AlphaNews Live

Υπόθεση «Σάντη» στο μικροσκόπιο - Τι λέει ο δικανικός επιστήμονας Αλέξης Μαύρος

Δικανικός επιστήμονας Αλέξης Μαύρος για υπόθεση «Σάντη»

Sandy evidence dispute: Cyprus Mail reports Alexis Mavros’s comments

Υπόθεση Σάντης: Τα 10 σημεία που ρίχνουν σκιές στο αρχικό αφήγημα

The Sandy files: Philenews recap includes forensic examination findings

Διάσκεψη τύπου Δημήτρη Παπαδάκη στην παρουσία δικανικού εξεταστή

Υπόθεση Σάντη: Το … «είπα – ξείπα», τα τεκμήρια και ο ρόλος της Europol

Papadakis report: coverage of the examination and political reactions

Sandy case: reporting on the referral of evidence to Europol

Διάσκεψη Παπαδάκη για το πόρισμα του δικανικού ελέγχου στα τηλέφωνά του

Τρία κινητά, μηδέν ευρήματα: Σε ποια κατάσταση βρισκόταν το κινητό του Παπαδάκη την ώρα των μηνυμάτων

Αυτή είναι έκθεση για τα κινητά Παπαδάκη – Η αναφορά σε «παραμυθάδες»

Άφαντος ο «Άρχοντας» στις 73.000 συνομιλίες Παπαδάκη που εξέτασε ο Μαύρος

Ιδού το επτασέλιδο πόρισμα του εμπειρογνώμονα Μαύρου για τα κινητά Παπαδάκη

Αλέξης Μαύρος: Η υπόθεση Σάντη και ο ρόλος των ψηφιακών πραγματογνωμόνων

Ισχυρισμοί Δρουσιώτη: Θύμα πλεκτάνης δηλώνει ο Παπαδάκης | AlphaNews Live

Αυτά είναι τα αποτελέσματα του δικανικού ελέγχου στις συσκευές του Δημήτρη Παπαδάκη – ΕΙΚΟΝΕΣ

Καθαρός ο δικανικός έλεγχος στα τηλέφωνα του Παπαδάκη – Αιχμές από τον Αλέξη Μαύρο

Papadakis phone examination: coverage of Alexis Mavros’s findings

Πυρά Παπαδάκη σε Δρουσιώτη και ΑΛΜΑ, στη δημοσιότητα το πόρισμα του δικανικού ελέγχου-«Ζούμε στην εποχή που ηρωοποιούνται οι παραμυθάδες»

Ιδού η έκθεση για κινητά Παπαδάκη - «Η εποχή που ηρωοποιούνται παραμυθάδες»

Υπόθεση με sms Δρουσιώτη: Πολλαπλασιασμός ερωτημάτων

Στο ΤΑΕ Λευκωσίας ο Δημήτρης Παπαδάκης – Διαβάστε την κατάθεσή του

Papadakis complaint: report mentions the appointment of Alexis Mavros

Κατήγγειλε τον Δρουσιώτη στην Αστυνομία ο Παπαδάκης – Αυτούσια η κατάθεσή του

Απευθείας από ΚΥΠ και Αστυνομία οι παρακολουθήσεις – Τρία νομοσχέδια

Proposed surveillance legislation: technology and independent oversight

Start with the question.Follow the evidence.

Digital evidence.
Clear answers.

Complex evidence.
A clear way forward.

A traceable process.
From source to finding.

Start with the question.
Follow the evidence.

A clear brief.
A useful examination.

Make sense of
your digital evidence.