Digital examination and preservation for businesses, public bodies, legal teams and authorised investigations. Every request begins with named authority, an agreed method and a report another professional can assess.
The work to commission
An examination can cover a device, a set of accounts or a defined incident. The scope identifies the sources, relevant period, authority to access them and expected work products. It also records what the available material cannot establish.
Identify the original sources, current device state and relevant retention limits. Agree collection, integrity records, custody and storage before examination changes the material.
Name the question, authority, relevant people, systems and dates. Separate a narrow technical question from assumptions about what an examination will prove.
Correlate the available records and document methods, time zones and gaps. Test alternative explanations and keep observed facts separate from interpretation.
Provide the agreed findings and supporting references in a reviewable form. State limitations, excluded material and follow-up questions alongside the conclusions.
Plan the handover, identify the material and preserve relevant computer, storage, mobile or account records. Acquisition, integrity checks and custody are documented for the actual source.
Computer and storage examinationsMobile-device evidenceReview defined events across files, user activity, email and available cloud records. Separate observed facts from interpretation and identify gaps, time-zone assumptions and alternative explanations.
Incident reconstructionCloud and account recordsDeliver the agreed report with references to relevant material, the examination method, limitations and an organised disclosure set where included. Independent review should be able to follow the reasoning.
Reporting and reviewCollection for disclosureA statement of work names the deliverables, schedule, authorised contacts, acceptance criteria and procurement route. Repeat work can use an agreed service schedule with a separate authorisation for each matter.
The assignment identifies the responsible examiner and any specialist resource. Relevant experience, licensing, conflicts and contract-specific security requirements are reviewed before acceptance.
The agreed handling plan covers work location, access, transfer, retention and destruction. Protected or classified material is not requested through this public website.
Recovering accessible files from damaged media is a different assignment from preserving and examining evidence. If a device needs board-level work or a clean-room recovery route, the physical intervention and its effect on the evidence are planned and authorised separately. Tell us which objective comes first before anyone attempts a repair.
Describe the material, the question and the required delivery. We establish authority, specialist suitability, security requirements and the written scope before evidence is transferred.
Planning references: NIST forensic techniques guidance and Government of Canada contract security requirements. The accepted assignment specifies the applicable requirements and qualified resources.
