10 · SPECIALIST INVESTIGATIONS & INDEPENDENT REVIEW
Corporate Data Transfer Investigations
Investigate what happened to company information.
Technical investigation of suspected copying, disclosure, retention or deletion of business information, including matters involving employees or former collaborators. We correlate file activity, external media and available company-system records to identify events supported by the evidence and explain their context.
When an employee or collaborator leaves, or confidential information appears where it should not, a business may need to know whether company files were copied, sent, retained or deleted, and when.
We examine the available computers, accounts and company-system records for file activity, connections of external storage devices, uploads to cloud services, email transmission and deletion. We correlate these records into a timeline of the events the evidence supports, and explain their context.
Investigations involving employees raise privacy and employment-law considerations. The authority, scope and access for the examination are agreed in advance with you and your legal adviser.
Questions this examination can help answer
- Were company files copied to a USB device or a personal account?
- Were documents emailed or uploaded outside the company?
- Were files deleted before a device was returned?
- When did the relevant activity take place?
What the evidence can and cannot establish
Records may show that files were accessed, copied or transferred; what happened to the data afterwards, and who was responsible, may require other evidence. Routine use and retention settings can overwrite relevant traces, so prompt preservation matters.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What should I do with a device that may contain evidence?
Contact us promptly for advice specific to the device and its current state. Avoid unnecessary use, resets, updates, deletions and attempts to recover data yourself. Seek guidance before changing its power or network state, and record who has handled it. The appropriate preservation steps depend on the source and circumstances.
How are cost and timing assessed?
They depend on the questions, amount and condition of the material, access requirements and examination needed. We discuss the proposed scope, timing and fees before the examination starts. Tell us about relevant deadlines at first contact so that feasibility can be assessed.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek