Recovery to
evidentiary standard.
Data recovery and analysis from compromised devices, malicious software detection, and computer and phone monitoring with live tracking and GPS location services.
Service Overview
What this service covers.
- Service
- Digital Forensics
- Engagement
- By Referral Or Introduction
- Confidentiality
- Mutual Written Agreement
- Led By
- A Named Senior Advisor
When a device is suspected of compromise, the worst outcome is a well intentioned IT response that destroys the evidence. We acquire devices under chain of custody, image them in a controlled environment, and analyse what is present without altering the underlying media.
Our examiners reconstruct deleted material, identify implants and commercial spyware, and produce a written narrative that explains what happened, when, and through which vector — in language that counsel, the client and, where required, a regulator can act upon.
Where live monitoring is appropriate and lawful, we run it discreetly and under written authority, with GPS and geolocation intelligence supplied at the cadence the brief requires.
Departing Executive
Suspected Spyware
Litigation Disclosure
Capabilities
The tools we bring.
Advisor led
Evidence based
Private and discreet
Device Acquisition
Forensic imaging of phones, laptops and storage media under documented chain of custody by trained examiners.
Implant & Malware Detection
Identification and analysis of commercial spyware, advanced implants and conventional malware.
Deleted Data Recovery
Reconstruction of deleted files, messages and call records to the technical limits of the media.
Live Monitoring & Tracking
Lawful live monitoring with GPS and geolocation intelligence where authority and circumstance support it.
When To Engage Us
Situations that warrant action.
Most engagements reach us late, after the perimeter has already been crossed. The right moment is earlier — when the concern is plausible, the exposure is named, and the next decision is still yours to take.
Departing Executive
A senior figure has left and the question is what they took, what they accessed, and what now sits outside the perimeter.
Suspected Spyware
A client has reasonable grounds to believe a device has been targeted by commercial grade intrusion.
Litigation Disclosure
Counsel requires deleted, recovered or contested material surfaced and certified to evidentiary standard.
Engagement Process
From inquiry to delivery.
A named senior advisor controls the engagement, updates are measured, and findings are delivered only to approved recipients.
Secure Handover
Devices are collected in person by a partner or named courier under sealed custody.
Forensic Imaging
A bit for bit image is taken in the lab; all analysis runs against the image, never the original.
Examination
Examiners surface implants, recover deleted material and reconstruct the timeline of compromise.
Written Narrative
A counsel grade report is delivered, with the original device returned or destroyed as instructed.
Most evidence is destroyed by the first person who reacts to the problem. Our rule is always preservation before interpretation.
Senior Forensic Examiner
Deliverables
What you receive.
Where the evidence supports it, we will testify. Where it does not, we say so plainly in writing, signed by a senior advisor.
- Forensic image of every acquired device
- Implant and malware identification report
- Recovered deleted material where viable
- Timeline of compromise with vectors identified
- Counsel grade written narrative
- Chain of custody documentation in full
In Confidence
The questions clients ask first.
Drawn from first meetings with chairs, family offices and senior counsel. If your question is not here, ask it in confidence.
Can you examine a device without alerting the user?
Yes, where lawful authority exists. Imaging can be performed and the device returned without observable change to the user environment.
Do you handle commercial spyware cases?
Yes. We have working knowledge of advanced commercial toolsets and their indicators on iOS and Android, and partner with civil society organisations where appropriate.
Will your examiners give evidence in court?
Yes, where the report supports it. Our senior examiners are accustomed to giving oral evidence and being cross examined on technique.
How long does an examination take?
Indicative timelines are agreed in scoping. Triage findings on a single phone are typically available within 72 hours; deep examinations of multi device estates run longer.
Related Services
Often delivered alongside.
Intelligence gathered with precision.
Conventional, rural and electronic surveillance alongside personal and corporate investigations, delivered with detailed evidence reporting.
Learn More
Environments certified secure.
Technical surveillance countermeasures to detect covert devices and protect against industrial espionage and intellectual property theft.
Learn More
Comprehensive digital protection.
Penetration testing, encrypted communications and personal operating security engineered for clients with permanent digital exposure.
Learn MoreNext Step
A confidential matter, privately discussed.
Speak directly with a senior advisor. Every inquiry is held in confidence from the first word.