The evidence is often in the data.
Specialist digital forensic capability — preserving, recovering and analysing digital evidence to a standard that holds up in scrutiny and in court.
Where the evidence lives.
Computers and laptops
Mobile phones and tablets
Data storage
Cloud accounts
Deleted and lost material
Documents and their metadata
Financial and transactional records
How we work.
Preserve before anything else
We take a forensic image first and work only from copies. The original is never altered, because a single careless step can put the whole body of evidence in question.
You don't choose what we look at
We image and then filter, rather than asking you to send us the documents you think matter. That is what keeps our findings independent, and it is the first thing opposing counsel will test.
Chain of custody, written down
Every item is hashed when we receive it and that hash is recorded. Anyone can later confirm that what we examined is what we were given, unchanged.
Filter to what is relevant
A terabyte of data is rarely the job. We narrow to the accounts, date ranges and material that bear on the question, and we record what we excluded and why.
Test assertions against primary sources
An analysis is not evidence of itself. Every assertion is matched back to an original document, and where no document supports it, we say so.
Report what we did not find
Findings that are unsupported or contradicted go in the report alongside the ones that help. A report that only contains good news is worth very little when it is challenged.
What you receive.
A forensic report
Method, findings, and the limits of those findings, written so a non-technical reader can follow it.
An opinion that can go before a court
Expressed by the person who formed it, and prepared to be tested.
A statement or affidavit
Where proceedings require it.
The preserved evidence and its hashes
So another expert can examine the same material and check our work.
A plain briefing
For you, or for your solicitor, on what the material does and does not establish.
What metadata can and cannot prove.
What it can establish
What it cannot
We say this plainly because a forensic opinion that reaches further than the data supports does not survive cross-examination — and it takes the rest of the case with it.
Who does the work.
The work is led by Daniel Baulch, a former detective with Victoria Police whose career was spent in organised crime and anti-corruption investigation. Digital evidence is assessed by someone who has had to put evidence before a court and defend it.
The forensic examination is led by Bobby Pabala, Lead Director of Digital Forensics, whose background spans serious fraud investigation, anti-corruption work and covert operations across Australia, New Zealand and the Pacific.