Encrypted device, 9 jurisdictions
A locked device sat at the centre of a cross-border commercial dispute. We recovered the container, reconstructed the timeline, and linked the artefacts to nine jurisdictions.
Evidence admitted in 3 jurisdictions
Case studies
Selected matters, anonymised. Client names and identifying details are withheld. The shapes of the work are real.
Cloud evidence, 40 TB
A regulator needed a defensible, proportionate review of a 40 TB cloud estate. We preserved the estate, culled it and produced a single review set.
98% reduction · 1 review set
Subject network, 120 entities
A 120-entity network across six countries. We mapped the relationships, resolved identities, and produced an evidence-linked network report.
6 arrests · 1 expert report
Ransomware, 72 hours
Contained a ransomware incident across 40 servers, preserved the forensic record and supported the recovery. The regulator accepted the report.
Contained in 72h · no ransom paid
Insider data exfiltration
Traced a suspected exfiltration to a single insider, reconstructed the access pattern and produced a court-ready report.
Settlement · 1 expert report
Second opinion on a contested report
Reviewed an opposing forensic report and identified methodological gaps that changed the outcome of the matter.
Report set aside · 1 expert statement
What we do not do
We work only on authorised matters.
Every engagement is scoped to a lawful authority — a client instruction, a court order, a regulatory mandate or a lawful internal investigation. We do not conduct unauthorised surveillance, and we do not act on behalf of a subject without a lawful basis.
Authorisation first. We confirm the lawful basis before any acquisition, and we document the authority in the case file. If the authority is unclear, we stop and advise.
Your case does not fit a template. Neither does our approach.
Tell us the question, the evidence and the authority. We will scope the matter and tell you what the digital record can prove.