Digital forensics · Incident response · Cyber readiness

ABOUT DFI

You should understand how your evidence is handled.

We work with you to agree how evidence will be collected, transferred, accessed, and retained. Those arrangements form part of the scope of your matter, so responsibilities are clear before the work begins.

01

Confirm the source and the instructions before collection.

We agree what is being provided, who can authorize the work and which devices, accounts or records are in scope. Source descriptions, identifiers and relevant access conditions help distinguish the original material from later exports or working copies. If another party supplied a collection, we document the available information about how it was obtained.

02

Keep collection and handling traceable.

We record the collection method, relevant dates, transfers and verification steps appropriate to the material. Different sources and acquisition methods have different coverage. Our documentation should make those boundaries visible so the reader does not mistake a selected export for a complete record of every available source.

03

Agree access and transfer arrangements.

We establish who may provide, receive and review the material, and the channel appropriate to the engagement. Please do not place evidence, passwords or private conversations in website forms or booking notes. Contact us first so sensitive material can be transferred through the agreed process.

04

Separate preservation from review and disclosure.

Keeping a source available does not mean every item must be examined or distributed. The agreed scope determines the review; counsel or the instructing party addresses privilege, relevance and disclosure decisions within their responsibilities. Where a court order governs the work, its collection and access boundaries need to be reflected in the instructions.

05

Set delivery and retention expectations explicitly.

We discuss the required output format, storage responsibilities and retention arrangements for the matter. Raise any data-residency, return, deletion or preservation requirement before work starts so it can be assessed and confirmed. No single retention period or storage arrangement should be assumed from this page.

YOUR NEXT STEP

What do you need to understand?

Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.

Speak with an expert