Client Portal
An examiner in blue nitrile gloves holds a smartphone at a dark forensic workstation, beside a connected external drive, a sealed evidence bag and tweezers, with a laptop running analysis software behind.

We collect, preserve and analyse data from computers, phones and cloud accounts so that what we find can be relied on in a disciplinary hearing, an insurance claim or a courtroom.

What we examine

Computers and laptops

Forensic imaging and analysis of Windows, Mac and Linux devices: file activity, deleted data, USB use, browsing history and evidence of data transfer.

Phones and tablets

Messages, call records, app data and location history from iOS and Android devices.

Email and cloud accounts

Microsoft 365, Google Workspace and other cloud platforms: sign-in history, mailbox rules, file sharing and audit logs, collected before retention periods expire.

Post-breach examination

After a suspected intrusion, we establish how access was gained, what the attacker did and what data was exposed, and give you a report for insurers, regulators and clients.

Malware analysis

Examination and reverse engineering of suspicious files to establish what they do, where they came from and what they touched.

Forensic collection only

If you have your own analysts or an instructed expert, we can image devices and accounts to an evidential standard and hand over verified copies.

What you receive

  • A written forensic report with a plain-English summary
  • A timeline of relevant activity
  • Exhibits and supporting data
  • A witness statement and expert testimony if required

Sound from first contact to final report

Preserve before examining.

We take a verified forensic copy and work only from that. The original is not altered.

Chain of custody.

Every handover, from collection to return, is logged and signed.

Recognised principles.

Our work follows the ACPO Good Practice Guide for Digital Evidence.

Repeatable findings.

Our methods and tools are recorded so another examiner can reproduce the result.

UK data handling.

Evidence is stored encrypted in the UK and securely destroyed, with written confirmation, when the matter closes.

Questions people ask

Often, yes. It depends on the device, how long ago the data was deleted and what has happened since. The sooner the device stops being used, the better the chance.

Usually. For laptops and phones we collect in person or by tracked courier. Cloud accounts and email can normally be collected remotely.

A forensic copy leaves no trace on the device. Whether you are entitled to examine it without telling them is a legal question we will raise at scoping.

Work is quoted per matter after a scoping call, based on the number of devices and the questions to be answered.

Need a device or account examined?

Tell us what you have and what you need to prove. We will explain what is recoverable and what it will take.

Talk to a forensic consultant