Digital Forensics
When an incident may lead to a claim, a dispute or an investigation, how evidence is handled matters as much as what is found. AS preserves and analyses digital evidence using defensible methods.
When you need this
- Security incident requiring a defensible record
- Suspected data theft by a departing employee
- Dispute over deleted or altered files
- Insurance or regulatory reporting after ransomware
- Need to establish a timeline of activity on a system
What we do
Forensic imaging
Bit-for-bit images with verified hashes and documented chain of custody.
Analysis
File system, artefact and timeline analysis to establish what happened, when and by which account.
Reporting
Clear written findings suitable for management, insurers or legal advisers.
How it works
- Step 1
Consultation and scope
We establish what failed, what has been tried, and which data matters most. This shapes a targeted plan rather than a generic one.
- Step 2
Secure imaging and diagnosis
Where possible the source media is imaged before any work, so the original is never altered. Diagnosis then determines the safest recovery method.
- Step 3
Recovery
Data is extracted from the image or source using methods matched to the failure — logical, structural or hardware-level as required.
- Step 4
Verification
Recovered data is checked for integrity and completeness, and a file list is shared so you can confirm what matters is there.
- Step 5
Secure delivery
Verified data is returned through an agreed secure method, with guidance on validation before it goes back into production.
What affects the outcome
Outcomes are never guaranteed. Every case is assessed on its own condition, and we tell you what is realistic before you commit.
- Physical condition of the media and the extent of any damage
- Whether the media has been written to, reformatted or re-initialised since the failure
- Encryption, corruption or partial overwriting of the data
- Availability of source data such as images, backups, logs or transaction records
- Attempts made before assessment (rebuilds, repair tools, repeated reboots)
Frequently asked questions
Can you recover deleted evidence?
Deleted data is recoverable in the same way as any other deleted data — until it is overwritten. Preserving the device immediately is the most important step.
Do you provide expert witness services?
Please contact us to discuss the specific matter and jurisdiction. [PLACEHOLDER: confirm scope]
Related services
Not sure what you're dealing with?
Describe the situation and we'll tell you what's realistic.