05 · DIGITAL EVIDENCE EXAMINATIONS
Malware, Spyware & Exploit Forensics
Assess suspected compromise and its relevance to the evidence.
Forensic examination of phones, computers and available email and cloud records for indications of malware, spyware, stalkerware, exploitation or unauthorised access. We correlate findings with disputed activity, including claims that malware was responsible. We assess what the evidence supports about timing and actions, distinguish potential capabilities from documented activity, and explain the limits of attributing actions to a person.
Concerns about compromise arise in different ways. A person may suspect that their phone is being monitored, an account may show activity its owner does not recognise, or a party may claim that malware, rather than a person, was responsible for the disputed actions. Each question calls for a different scope of examination.
We examine the available device data, installed applications, configuration and account access records for known indicators of compromise and other signs of unauthorised access, and correlate what we find with the timeline of the disputed activity.
Where indications are found, we assess what the evidence supports about when they appeared and what they did, distinguishing what a tool is capable of from what the records show it actually did. Where no indications are found, we explain the coverage of the examination and why that conclusion is not a guarantee that a device was never compromised.
Questions this examination can help answer
- Is there evidence of spyware or stalkerware on this phone?
- Was an email or cloud account accessed by someone else?
- Do the records support the claim that malware carried out the disputed actions?
- When did the suspected compromise begin, and what does the evidence show it did?
What the evidence can and cannot establish
Conclusions are limited to the material, methods and indicators available for the examination. Attributing actions to a specific person requires more than evidence of a compromise. ISS examines and reports; it does not provide threat removal, remediation or incident response.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
Can you confirm my phone is not infected?
We can examine a device for known malware, spyware and signs of compromise using the methods, indicators and source data available for the examination. If no such indicators are found, that conclusion is limited to the material and methods examined. It is not a guarantee that the device is free of malware or was never compromised. We explain the scope, coverage and limitations in the report.
What if the findings do not support my position?
Our technical assessment remains independent. We report material findings that support or challenge the position being examined, explain uncertainty and distinguish the evidence from assumptions. Your lawyer assesses the legal significance of the findings.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek