Who this is for
Forensic examination is worth commissioning when the answer has to convince someone other than you. If you only need to satisfy your own curiosity, it is usually more than you need.
- People who believe a phone or laptop is being monitored and need to know either way
- Anyone whose messages, images or documents will be relied on by an attorney or a court
- Businesses reconstructing how an account or device was accessed
- Attorneys who need the technical record built properly before they file
What the examination actually involves
Acquisition is performed on a write-blocked copy, never the original — the working image is separated from the source before anything is read. Every artifact is hashed on collection and re-verified before analysis, so its integrity can be demonstrated later rather than asserted. Examination then covers device storage, application databases, records that were deleted but remain recoverable, and the metadata that establishes when something actually happened rather than when it appears to have happened.
How a matter runs
An intake call establishes what you have and what question you need answered. We scope the work and quote it in writing before touching a device. Acquisition usually takes hours; examination takes longer and depends on how much data exists and how many questions you are asking of it. You get a named point of contact and updates at agreed intervals, and if we find early that the question cannot be answered from the available data, you hear that immediately rather than at the end.
What arrives at the end
A written report setting out method, findings and chain of custody, with exhibits attached and hash values recorded. It is written so another qualified examiner could follow the same steps and reach the same conclusion — that reproducibility is the property that makes findings hold up when they are challenged. Where a finding rests on a single artifact, the report says so rather than presenting it with the same confidence as a corroborated one.
Limits and legal considerations
We examine devices and accounts you own or are lawfully authorised to access, and we require confirmation of that authorisation before work begins. We do not access accounts belonging to other people, and we do not purchase stolen data. This is not procedural caution: evidence obtained improperly is worthless the moment anyone examines how it was obtained, and it can create liability for the person who commissioned it. Some questions also cannot be answered because the underlying records no longer exist — retention periods are short, and acting quickly materially affects what remains recoverable.
Questions people ask first
Can you tell whether my phone has monitoring software on it?
Often, yes — monitoring software leaves artifacts, and an examination can frequently establish what was installed and when. A clean examination is weaker evidence than a positive finding, though: it means nothing was detected in the data examined, not that nothing ever happened. We will tell you which of those two results you have.
Do you need to keep my device, and for how long?
Usually we need physical access for acquisition, which is typically a matter of hours rather than days. Analysis is then performed on the copy, so the device goes back to you. If being without your phone is itself a safety problem, say so at intake and we will plan around it.
Will an examination alert whoever installed the software?
It depends on what was installed and how. Raise this at intake before you do anything else — including before you change passwords or factory-reset the device, both of which can destroy the evidence and can signal to the other party that you know.
Can deleted messages be recovered?
Sometimes. Deletion frequently removes a reference rather than the underlying data, and application databases often retain more than the interface displays. Whether that holds in your case depends on the device, the application and how much time has passed. It is one of the first things an assessment establishes.