09 · DIGITAL EVIDENCE EXAMINATIONS
Social media & online evidence forensics
Posts, comments, accounts and websites: preservation, chronology and context.
Documented collection, preservation and examination of available social media and website content. We examine posts, comments, images, video and account information from public sources or through authorised access. We correlate the material with available original files and exports, assessing chronology, context and indications of change, with explicit limitations on linking a post or action to a particular person.
Online content can be edited, deleted or made private at any time. When a publication, post, image or file may become evidence in a dispute about published or reused content, it should be preserved in a way that records what was available, where and when.
We capture the available content with documented sources and collection times, preserve the collected material with integrity checks, and keep a record of the collection process. Where originals are supplied, we compare them with the published or reused content and identify the similarities and differences.
Our role is to document and compare the technical evidence. Whether content is defamatory, or whether its reuse infringes rights, are legal questions for your lawyer and the court.
Questions this examination can help answer
- What content was available at collection and how was it preserved?
- Are there different versions or indications of change?
- Do dates agree with available exports?
- What connects the activity to an account, and what connects it to a person?
What the evidence can and cannot establish
Collection records the content accessible at a particular time. Deletion, platform restrictions and incomplete data limit coverage. A profile name or post does not by itself establish which person performed an action.
Our examinations are independent and objective. We report material findings whether they support or challenge the position under examination. We explain what the digital evidence supports, the limitations that apply and what cannot be established.
Before you instruct us
What does a forensic report include?
The report addresses the agreed questions and identifies the material examined, methods, significant findings, supporting references and limitations. It separates observations from technical interpretation. Timelines and exhibits may accompany the report where relevant. A discussion with your lawyer and court testimony can be arranged where required and agreed.
THE APPROACH
A traceable process.
From source to finding.
A defensible finding needs a traceable basis. We document the acquisition, tools, procedures and limitations so that the examination and its conclusions can be independently assessed.
- 01
Define
Agree the authority, questions, relevant sources and scope with you and your legal adviser before examination begins.
- 02
Preserve
Document receipt, handling and transfers. Preserve source material and use verified forensic copies or appropriate exports wherever practicable. Record acquisition methods and appropriate integrity checks, including cryptographic hashes where applicable.
- 03
Examine
Check material findings against their sources. Correlate records and timelines, test alternative explanations and document examination coverage.
- 04
Explain
Report findings objectively. Distinguish observations, interpretation and limitations, with references that allow the reasoning to be followed.
A keyword result or a device event needs context. Our conclusions reflect the available evidence and the limits of the examination.
LET’S START WITH YOUR QUESTION
Make sense of
your digital evidence.
Tell us briefly about the matter and the digital sources involved. We can discuss the appropriate next step and the proposed scope.
Based in Cyprus · English & Greek