Services
Forensic Analysis
& eDiscovery
We preserve digital evidence from computers, phones and the cloud, maintain its evidentiary value and help establish what really happened.
Disputes and internal investigations are increasingly decided by digital traces – who copied, deleted or sent what, and when. We acquire data without altering the original, analyse it and document the whole procedure so that the results can be used in further legal or internal proceedings. We work for companies, law firms and public institutions.
When to contact us
- You need to reconstruct a sequence of events from computers, phones or cloud services
- An employee has left for a competitor and you suspect they took data or know-how with them
- You suspect company data has leaked – by e-mail, through the cloud or on a USB drive
- You are dealing with fraud, embezzlement or other suspicious conduct inside the company
- You need to establish who worked with specific files, when and how
- You need to recover deleted e-mails, messages or files
- You need to analyse large volumes of e-mails and documents
- The police, a court or the opposing party has requested electronic evidence from you
From data acquisition to an expert deliverable
We acquire the data
We acquire data in line with internationally recognised standards and document the whole process so that the way it was obtained and handled can be demonstrated.
We analyse it
We analyse the data according to the questions of the case – from recovering deleted data and communications through timelines to file activity and connected devices.
We prepare the deliverable
We summarise the findings in a clear report or an expert statement. Where the case requires it, we also prepare an expert witness report for court.
From our casework
A group of employees of a financial institution left for a competitor and the client suspected they had taken sensitive business information with them. We took over their computers and phones shortly after the resignations were handed in and preserved the data using forensic procedures, so that the way it was obtained and further handled could be demonstrated.
Analysis of system files and deleted data uncovered fragments of documents and e-mails that supported the client’s suspicion. The key information, however, came from recovered communications on one of the phones, which demonstrated a targeted transfer of business data to the competitor.
Frequently asked questions
Can deleted data and messages be recovered?
In many cases, yes. It depends on the type of device, how the data was deleted, encryption and what happened to the device afterwards. We recover documents, e-mails, communications and other data, and it is often possible to establish the circumstances of the deletion as well. The sooner a device is preserved, the better the chance of retaining the available traces.
Will the results of the analysis be usable in court?
We acquire data in line with recognised forensic procedures and document the whole process so that the way it was obtained and handled can be demonstrated. The deliverable can take the form of a report, an expert statement or, where needed, an expert witness report.
What should we do if we suspect an incident or a data leak?
If possible, stop using the device and do not delete or copy data in the usual way. Get in touch as soon as possible – depending on the situation, we will advise you on how to preserve the traces and whether the device needs to be physically secured.
Do I have to hand over the whole computer or phone?
With computers, data can in many cases be acquired on site, without the device having to leave the company for long. With phones and other devices, the procedure depends on the specific model, its security and the type of analysis required.
Can you get into a locked phone or an encrypted drive?
In some cases, yes. We use specialised software and hardware tools, and the options always depend on the specific device, system version and security in place. However, we provide these services only on the basis of a court order or in cooperation with law-enforcement authorities.
Can the analysis be carried out discreetly?
Yes, the procedure can often be planned so that it interferes with normal operations as little as possible. The specific approach is always chosen with regard to the legal framework and the circumstances of the case.
I suspect my device is being tapped or has been compromised. Can you find out?
Analysing compromised devices and investigating security incidents is one of our core professional activities. However, verifying suspicions of eavesdropping, spyware or unauthorised surveillance requires a specific approach and cannot always be reliably confirmed or ruled out.
We therefore focus on these cases primarily as part of incident response for organisations. We do not routinely examine individual suspicions concerning private devices. Possible exceptions are assessed on the basis of a prior consultation and the specific technical circumstances.
How long does the analysis take and how much does it cost?
Data acquisition can be a matter of hours; the analysis itself usually takes days to weeks depending on the scope and complexity of the case. After the initial consultation we will propose an approach and estimate the scope of work and the price.
Dominik Novák
consultant
The first consultation is free and confidential.
Not sure whether this is a case for us?
Call us – the first consultation is free, confidential and comes with no obligation.