Evidence & investigations · digital forensics
The way data is treated when it has become evidence is equally important as what it shows. Before looking at the evidence, we take images of all the data; record everything we do while examining the data; and document our reports so an independent investigator (or a court) can track the process. Independent, confidential, honest about exactly what we are. From the first phone call to 01273 964902, through to the finalised report, all Brighton work will remain confidential.
Talk it through, in confidence
01273 964902
| The problem as described | What we establish | What you receive |
|---|---|---|
| A device which could help resolve a dispute | We write-block an image and analyse files, artefacts and timelines | A plain-English findings report |
| Leaver suspected of removing company data | Activity of USB, cloud, webmail, deletions and wipe activity in a timeline | Investigation report that HR and legal can take action upon |
| Any deleted material which may be relevant to a legal case | Was it there? When was it there? What happened to it? Recovered forensically | What was recovered, how was it recovered and when was it recovered |
| Encrypted volume with lawful authority to open | Decryption using Passware when keys or password(s) can be established | Decrypted evidence, method documented |
| Matter going to court | Same job, but reported under CPR Part 35 or CrimPR Part 19 | A court-ready expert report |
| Evidence from CCTV/DVR footage | Continuity of recovery & export, covered by our CCTV hub | Playable footage + continuity records |
Each instruction begins with a private discussion: What occurred? Which equipment and accounts are involved? And what question does the evidence need to answer? You will get a fixed written quotation prior to starting any examination, and there is no cost for the initial review of the scope of work.
Every device is first imaged via a hardware write blocker before anyone has access to look at anything. The original is evidence... evidence doesn't get browsed.
We run analysis using the forensic image within forensics software (such as OSForensics), including but not limited to file activity, artefacts, deleted material, timelines, logging every single action taken during the analysis process.
Our findings will always be presented in clear English, directly related to your actual questions posed. The full technical details will also accompany this information. In no circumstance will the findings be diminished based upon who pays for them.
Upon completion of the examination you will obtain the results of the investigation (report, exhibits and supporting documentation) complete with hashes, continuity records, and our contemporaneous record of activities. In the event the work is challenged by another professional or a tribunal, all of the relevant information required to support our findings will remain available for their use.
Why private, prompt capture matters: in December 2022, HMICFRS reported there were over 25,000 devices waiting to be examined within police digital forensics queues. A BBC study on Crown Prosecution Service discontinuance codes, undertaken jointly with the University of Leicester, showed that there were over 30,000 English and Welsh cases discontinued due to loss/misplacement/insufficiency of evidence between October 2020 and September 2024. When evidence is captured promptly and properly it does not end up in these queues.
| The system | What it does on an instruction | Why this one |
|---|---|---|
| X-Ways Forensics | Analysis of the forensic image, looking at file activity, artefacts, deleted material and timelines | Fast and light enough for a small lab to use properly rather than poorly |
| OSForensics | Collection, indexing & searching across Windows systems and the images taken of them | General discovery work on a system (registry, recent usage, connected device history) |
| Passware | Decryption where the instructing party has lawful authority and a key can be identified/obtained | This is the only honest route into an encrypted volume. Either it works or it does not |
| Atola Insight Forensic | Hardware-based write block acquisition with hashing built in | Imaging and reporting in one action, therefore no need to assemble continuity afterwards |
| ACE Lab PC-3000 & Data Extractor | Access at the firmware level when evidence is also a failing drive | Evidence does not stop being evidence due to media failure |
Why we put this in writing: criminal procedure law has made it mandatory since 2019 to disclose anything which could affect an expert's credibility, specifically non-accredited status. This is honesty, it is not simply a style preference; this will determine whether evidence survives scrutiny.
Files a client was adamant had been stolen turned out, via timeline analysis, to have been deleted from a shared drive due to a sync configuration issue, and most were still able to be recovered. The honest answer provided resolution to the matter much quicker than the suspected one would have.
Preserving and examining electronic data so it is reliable. Devices are imaged before they are examined. Each step of the examination is documented. Findings are provided in a report that allows another examiner to repeat the steps taken.
Each case is scoped individually. Imaging, analysis and reporting are priced together as part of one written quote, given after an initial complimentary scoping conversation and before any work begins, so there is no meter running.
No. We work on computers, drives, storage media and CCTV systems, and not on mobile devices such as smartphones or tablet PCs. However, if a smartphone is relevant to your case, we will tell you so and provide contact information for an appropriate specialist.
We are an independent forensic laboratory and are not accredited by UKAS or ISO standards and clearly indicate this within our report(s) as required by law. In place of accreditation, we provide disclosed methodology (write-blocked imaging, hashing of files, logging of processes performed, etc.) which allows for reproducible results. Reports can be generated in compliance with CPR 35 or CrimPR 19.
Loops destroy data, artefacts age and eventually deadlines expire. Open a case first: the initial scoping call is free and confidential either way.