07 · DIGITAL EVIDENCE EXAMINATIONS
Electronic Document & Metadata Examination
Trace the available document history.
Examination of document metadata, versions and indications of editing or transfer. We correlate file properties with available device records and explain what can be established about changes, timing and authorship.
Disputes about contracts, minutes, invoices, letters and other documents often turn on when a file was created or changed, which account or software was involved, and whether the version presented is the original. Word, PDF, Excel and email files can carry internal metadata and version information relevant to those questions.
We examine document properties, internal metadata, embedded information and available earlier versions, and correlate them with file-system records, email records, cloud storage history and other traces on the devices involved.
Metadata can be changed, carried over from templates, or affected by copying and conversion. We therefore test each property against the other available evidence, and explain what can and cannot be established about changes, timing and authorship.
Questions this examination can help answer
- Was this document created or modified on the date it bears?
- Is this the original version, or has it been edited?
- Which device, account or software is associated with the file?
- Was the document sent, copied or transferred, and when?
What the evidence can and cannot establish
Document metadata is not a signature. It can be altered or inherited, and on its own it does not identify the person who wrote or changed a document.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What does a forensic report include?
The report addresses the agreed questions and identifies the material examined, methods, significant findings, supporting references and limitations. It separates observations from technical interpretation. Timelines and exhibits may accompany the report where relevant. A discussion with your lawyer and court testimony can be arranged where required and agreed.
Can you review a report by the police or another expert?
Yes. An initial technical review may be possible from the report and its exhibits. Checking the underlying findings may also require forensic copies, extraction files, source devices or other disclosed data. We identify what is available, what is missing and how that affects the review.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek