Digital forensics
Preserve evidence. Reconstruct events. Inform decisions.
We analyse digital evidence in a structured manner to support internal investigations, understand incidents and establish the sequence of events. Whether the question is how an attacker got in, whether an employee copied client data, or what really happened to a deleted set of records, the answer has to stand up to scrutiny. We collect evidence with authorisation, record its integrity, analyse it methodically and report what the evidence shows and what it does not.
Business value
Evidence-based decisions with traceability of the analysis performed.
Digital forensics
Four stages, each with a clear deliverable. Where AI helps, it is marked.
Scope definition and authorised evidence collection
We agree in writing what is being investigated, which devices and accounts are in scope, and who authorises access.
Data acquisition with integrity and custody records
Forensic copies of disks, phones, mailboxes and cloud accounts, with hash values and a custody log for every item.
Extraction and searchAnalysis of devices, logs and relevant digital artefacts
Recovery of deleted files, examination of system and application logs, browser and email history, and USB or transfer activity.
Evidence triageTimeline reconstruction and identification of indicators
A time-ordered account of what happened, the indicators to look for elsewhere, and a report written for the audience that has to act on it.
Event correlationThree AI use cases, all optional
Optional. Every AI feature uses data you approve, can be switched off, and keeps a person in the loop.
Evidence triage
Sorts thousands of recovered files and messages by relevance to the questions under investigation, so analysts start with what matters.
Extraction and search
Finds names, numbers, documents and phrases across images, PDFs and chat exports, including in Portuguese.
Event correlation
Links log entries, file activity and account actions across devices into one sequence for the analyst to verify.
Preserve evidence. Reconstruct events. Inform decisions.
- You suspect data theft, fraud or misuse of systems by an insider.
- A security incident has been contained and management needs to know how it happened.
- Legal counsel, HR or a regulator needs findings that can be defended.
Delivery with clear criteria.
Project, recurring service or specialist engagement. The model and indicators are defined in the proposal.
Assess
Goals, data, systems and constraints.
Design
Scope, architecture, integrations and plan.
Implement
Configuration, development and testing.
Validate
Acceptance, quality and knowledge transfer.
What clients ask us
Is the evidence admissible?
We follow recognised acquisition and custody practices and document every step. Whether evidence is used in a legal process is decided with your counsel; our reports are written to support that.
Can you examine phones and cloud accounts?
Yes. Mobile devices, laptops, servers, Microsoft 365 and Google Workspace accounts, and exports from messaging applications.
How confidential is the work?
Engagements are covered by a confidentiality agreement, work is restricted to named analysts, and evidence is stored encrypted and returned or destroyed at the end as you instruct.
