10 · SPECIALIST INVESTIGATIONS & INDEPENDENT REVIEW
Internal corporate investigations & digital evidence
Investigating copying, disclosure, changes or deletion of business data.
Technical support for internal corporate investigations through the examination of digital evidence. We investigate possible copying, disclosure, retention, changes or deletion of business information, including matters involving employees or former associates. We correlate file, device and account activity with available logs to establish the chronology and context of events.
When an employee or collaborator leaves, or confidential information appears where it should not, a business may need to know whether company files were copied, sent, retained or deleted, and when.
We examine the available computers, accounts and company-system records for file activity, connections of external storage devices, uploads to cloud services, email transmission and deletion. We correlate these records into a timeline of the events the evidence supports, and explain their context.
Investigations involving employees raise privacy and employment-law considerations. The authority, scope and access for the examination are agreed in advance with you and your legal adviser.
Questions this examination can help answer
- Were files copied to external storage or a personal account?
- Are there indications of sending or sharing outside the company?
- Which files changed or were deleted, and when?
- What alternative explanations are supported by the available evidence?
What the evidence can and cannot establish
A recorded action does not automatically establish the person, intent or lawfulness behind it. The examination concerns digital evidence and is not a financial or statutory audit. Access and scope are agreed in advance with the business and its legal adviser.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What should I do with a device that may contain evidence?
Contact us promptly for advice specific to the device and its current state. Avoid unnecessary use, resets, updates, deletions and attempts to recover data yourself. Seek guidance before changing its power or network state, and record who has handled it. The appropriate preservation steps depend on the source and circumstances.
How are cost and timing assessed?
They depend on the questions, amount and condition of the material, access requirements and examination needed. We discuss the proposed scope, timing and fees before the examination starts. Tell us about relevant deadlines at first contact so that feasibility can be assessed.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek