Client Portal
Illustration of a digital investigation: a glowing magnifying glass over a fingerprint, linked to icons labelled Digital Evidence, Cloud Investigation, Data Analysis, Mobile Forensics, Link Analysis and Threat Intelligence, with a list of evidence sources (emails, files, chat logs, browser history, network activity), a laptop, a world map with location pins and a locked Digital Evidence folder.

Independent, confidential investigation of digital misconduct, data theft and fraud. We establish the facts, preserve the evidence and report in terms a board, a solicitor or a tribunal can use.

What we investigate

Employee misconduct

Suspected policy breaches, misuse of company systems, harassment and undisclosed outside interests. We work alongside HR and your legal advisers and keep the circle of knowledge small.

Data theft and departing employees

Client lists, designs or pricing leaving with someone who has resigned. We establish what was taken, when, and where it went.

Fraud and payment diversion

Invoice fraud, mailbox compromise and impersonation. We trace how the fraud worked and what the attacker accessed, and produce a report for your bank, insurer or the police.

Unauthorised access

A suspected break-in to email, cloud storage or a business system. We confirm whether it happened, how, and what was exposed.

Online harassment and impersonation

Anonymous accounts, fake profiles and defamatory content aimed at your business or your people. We preserve the content and work to attribute it.

Why use an independent investigator

Impartiality.

Findings from an outside specialist carry more weight than an internal IT review, especially when the subject is senior or the matter may reach a tribunal.

Evidence preserved properly.

Well-meant internal checks often alter the data they are examining. We preserve first, then examine.

Expert witness capability.

We can provide statements and give evidence if the matter proceeds.

One team from start to finish.

Open source research, forensic examination and reporting are handled together.

Process

  • 01

    Confidentiality.

    A non-disclosure agreement before you share any detail.

  • 02

    Scope.

    We agree the allegation or question, the people and systems involved, and the legal basis for the work.

  • 03

    Preserve.

    Devices, accounts and logs are secured before anything else.

  • 04

    Investigate.

    Forensic examination, open source research and timeline reconstruction.

  • 05

    Report.

    Written findings, supporting evidence and a debrief.

  • 06

    Support.

    Witness statements, disciplinary or legal proceedings, and recommendations to stop it happening again.

Questions people ask

It depends on the question. A single device and a narrow question can be answered in days. Matters with several people, systems or months of activity take longer. We give you an estimate at scoping and tell you if it changes.

Speak to us before you do. Once someone knows they are under suspicion, evidence can be deleted in minutes. We can often preserve it without alerting them.

Only with their consent or a court order. We will advise on what can lawfully be examined; your solicitor should confirm the employment law position.

If personal data has been exposed you may need to notify the Information Commissioner's Office within 72 hours. Fraud and cyber crime should be reported to the police through the national reporting service. We can help you prepare both.

Think something has gone wrong?

Speak to us before you act. An early conversation can save the evidence.

Book a confidential call