ABOUT DFI
Your questions guide us. The evidence shapes our findings.
We start with what you need to understand, agree the work needed to investigate it, and explain how the evidence supports our findings.
01
Start with the decision the evidence needs to inform.
A disputed conversation, suspected information movement and an active cyber incident call for different work. We begin with the question you need answered, the sources that may help and the decision or deadline ahead. This keeps the engagement focused on useful findings rather than collecting material without a clear purpose.
02
Agree the sources, authority and deliverable.
We identify relevant devices, accounts, custodians and dates with you, then confirm access arrangements and the scope of examination. Preservation, extraction, detailed analysis and expert reporting are distinct activities. We explain which are proposed and what you should expect to receive before proceeding.
03
Make the path from source to finding visible.
We document the collection and examination methods, retain the context needed to interpret the records and connect findings to supporting material. A conversation export may help a legal team review an exchange; a technical report may be needed to explain a disputed feature or chronology. The agreed output should fit its intended use.
04
Test explanations rather than defend an allegation.
An unusual timestamp or account event is a starting point, not necessarily proof of what happened. We distinguish observations from interpretation and opinion, consider relevant alternative explanations, and identify information that supports or challenges the initial concern. A question left unresolved is reported as unresolved.
05
Keep changes and limitations part of the discussion.
Access restrictions, missing records or new evidence may affect what can be examined. We raise their implications for scope and conclusions rather than allowing an assumption to become a finding. At delivery, we explain the supported conclusions, remaining questions and any further work that would require separate instructions.
YOUR NEXT STEP
What do you need to understand?
Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.