The evidence is often in the data.
Specialist digital forensic capability — preserving, recovering and analysing digital evidence to a standard that holds up in scrutiny and in court.
Where the evidence lives.
Computers and laptops
Mobile phones and tablets
Data storage
Cloud accounts
Deleted and lost material
Documents and their metadata
Financial and transactional records
How we work.
Preserve before anything else
Where the device and its condition allow, we take a forensic image first and work only from copies. Originals are preserved as far as the method allows, because a single careless step can put the whole body of evidence in question.
You don't choose what we look at
We image and then filter, rather than asking you to send us the documents you think matter. That is what keeps our findings independent, and it is the first thing opposing counsel will test.
Chain of custody, written down
Every item is hashed when we receive it and that hash is recorded. Anyone can later confirm that the material we examined is the material we were given, unchanged in our hands — the hash evidences the integrity of what was acquired, not the authenticity of everything the file claims about its own history.
Filter to what is relevant
A terabyte of data is rarely the job. We narrow to the accounts, date ranges and material that bear on the question, and we record what we excluded and why.
Test assertions against primary sources
An analysis is not evidence of itself. Every assertion is matched back to an original document, and where no document supports it, we say so.
Report what we did not find
Findings that are unsupported or contradicted go in the report alongside the ones that help. A report that only contains good news is worth very little when it is challenged.
When digital evidence changes the picture.
- Suspected unauthorised access to systems, or data taken on the way out the door.
- Documents whose authorship, version or date is disputed.
- Workplace messages that are described differently by the people who sent them.
- Transaction and system records that need to be read together to make sense.
- Corporate or civil matters where the documentary account is incomplete.
In each of these, the data is rarely the whole answer — but it is often the part that cannot be talked around. We use it to establish sequence and activity, then place it alongside the documents and accounts gathered in the wider investigation.
What you receive.
A forensic report
Method, findings, and the limits of those findings, written so a non-technical reader can follow it.
An opinion that can go before a court
Expressed by the person who formed it, and prepared to be tested.
A statement or affidavit
Where proceedings require it.
The preserved evidence and its hashes
So another expert can examine the same material and check our work.
A plain briefing
For you, or for your solicitor, on what the material does and does not establish.
What metadata can and cannot prove.
What it can establish
What it cannot
We say this plainly because a forensic opinion that reaches further than the data supports does not survive cross-examination — and it takes the rest of the case with it.
Before examination begins.
The first conversation is about authority and access as much as technology. We confirm who owns or lawfully controls the devices and accounts, who the custodians are, and on what basis they can be examined. We then agree the questions the examination is meant to answer, and scope the work to those questions rather than to everything the data could theoretically be asked.
- The devices, accounts and systems that may hold relevant material.
- Who uses or controls each of them.
- The dates or period the matter concerns.
- What you need the examination to establish.
- Anything at risk of being lost, reissued or overwritten.
- Whether a legal adviser is engaged, so the work can be coordinated with them.
Where something is at risk, preservation comes first and analysis follows. Talk to us before a device is accessed, wiped, reissued or handed back — a short conversation at that point often decides whether the material is still there to examine.
What the data may not be able to give you.
What can be examined depends on the condition of the device, whether it is encrypted, and whether lawful access and the necessary permissions exist. Some material cannot be reached at all.
What survives depends on retention settings, deletion, overwriting, and which logs a provider or system actually keeps and for how long. We cannot guarantee recovery, and we do not promise it in advance of looking.
Metadata needs context. It can show that something happened on a device at a time; it does not, on its own, establish who was at the keyboard or why. We corroborate it before relying on it, and we say in the report where corroboration was not available.
Common questions.
Can deleted data always be recovered?
No. Recovery depends on the device, how it stores data, how much has been written since, and whether the space holding the deleted material has been overwritten. Some material comes back intact, some in fragments, and some not at all. We tell you what was recoverable and what was not.
Can we just send you exports we already have?
Yes. Existing exports can be a useful starting point. We assess how they were produced, what they contain, and whether provenance, completeness or metadata can be checked. If additional acquisition is needed, we agree that with you and document any limitations.
How does digital work fit into a wider investigation?
Usually as one strand of evidence among several. Data can establish sequence and activity; interviews and documents supply the context. We run the two together so the findings are tested against each other rather than in isolation.
Acting personally rather than for an organisation? See how we work with individuals.
Who does the work.
The work is led by Daniel Baulch, a former detective with Victoria Police whose career was spent in organised crime and anti-corruption investigation. Digital evidence is assessed by someone who has had to put evidence before a court and defend it.
The forensic examination is led by Bobby Pabala, Lead Director of Digital Forensics, whose background spans serious fraud investigation, anti-corruption work and covert operations across Australia, New Zealand and the Pacific.