04 · DIGITAL EVIDENCE EXAMINATIONS
Computer & Mobile Phone Forensics
Preserve the source. Examine the available data.
Authorised forensic acquisition, preservation and examination of computers, mobile devices and storage media. We extract relevant data and recover deleted material where technically possible, recording the methods used and the limits of the available evidence.
Phones, computers and storage media often hold the records that matter in a dispute: messages, call logs, photographs and videos, location data, documents, browsing history and application data. How that material is acquired affects what can later be relied on, so we document the handling of each source from receipt onward.
Wherever practicable, we work from verified forensic copies or appropriate exports rather than the original device, and record the acquisition method and integrity checks, including cryptographic hashes where applicable. The method available depends on the device, its condition, its security state and the access lawfully provided.
Deleted material can be recovered only where the data, or traces of it, remain. We explain what was recovered, what could not be recovered and why, and we check material findings against their source before reporting them.
Questions this examination can help answer
- What do the device records show about a particular period or event?
- Can deleted messages, files or images be recovered?
- Are the records on the device consistent with the account given by a party or witness?
- Do the device records indicate use at the time alleged?
What the evidence can and cannot establish
Encryption, device security, damage, overwriting and the access available can limit acquisition and recovery. Device records show activity on a device or account; on their own, they do not identify the person who used it.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What should I do with a device that may contain evidence?
Contact us promptly for advice specific to the device and its current state. Avoid unnecessary use, resets, updates, deletions and attempts to recover data yourself. Seek guidance before changing its power or network state, and record who has handled it. The appropriate preservation steps depend on the source and circumstances.
What does a forensic report include?
The report addresses the agreed questions and identifies the material examined, methods, significant findings, supporting references and limitations. It separates observations from technical interpretation. Timelines and exhibits may accompany the report where relevant. A discussion with your lawyer and court testimony can be arranged where required and agreed.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek