08 · DIGITAL EVIDENCE EXAMINATIONS
Image & video forensics
Original files, metadata, timeline consistency and indications of alteration — including CCTV and alarm logs.
Forensic examination of photographs, video and CCTV recordings. We examine available original files, metadata, timeline consistency and indications of editing or alteration. We compare versions and correlate the material with other digital evidence, explaining what can be established and the limitations of the examination.
Where relevant to the case, we also examine available alarm and security-system logs to reconstruct the sequence of events.
CCTV recordings and alarm or monitoring logs can show when people arrived and left, when a system was armed or disarmed, and the order in which events took place. They are also easily lost: many systems overwrite recordings automatically under their retention settings.
Where possible, we arrange preservation of the original recordings or native exports rather than relying on copies, screen recordings or compressed clips, and we document the system, its time settings and the export process.
We examine recording continuity and gaps, differences between system clocks and actual time, and the sequence of events across cameras. Where records are available, we correlate the video with alarm activation, arming, disarming and monitoring-centre response, producing an event timeline that can be followed and checked.
Questions this examination can help answer
- Are there indications of editing or differences between versions?
- Does the metadata agree with the available timeline?
- Are there gaps or clock offsets in CCTV recordings?
- Do the images agree with available alarm logs?
What the evidence can and cannot establish
Compression, conversion, image quality and missing original files limit the examination. Metadata may have changed. The absence of indications of editing does not by itself establish that content is authentic.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What should I do with a device that may contain evidence?
Contact us promptly for advice specific to the device and its current state. Avoid unnecessary use, resets, updates, deletions and attempts to recover data yourself. Seek guidance before changing its power or network state, and record who has handled it. The appropriate preservation steps depend on the source and circumstances.
What does a forensic report include?
The report addresses the agreed questions and identifies the material examined, methods, significant findings, supporting references and limitations. It separates observations from technical interpretation. Timelines and exhibits may accompany the report where relevant. A discussion with your lawyer and court testimony can be arranged where required and agreed.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek