Employee departures & confidential information
Assess access to business records and possible copying, transfer or deletion around a departure.
COMPUTER FORENSICS
Computer forensics for litigation
Understand the files, activity and digital traces that matter to your case. DFI advises lawyers and litigants on the right evidence sources, preserves computer data and explains the findings in clear, practical terms.
COMPUTER EVIDENCE
Preserved imageIntegrity recorded
Clear findingsLinked to source records
EXPERT CONSULTATION FOR YOUR MATTER
Evidence that helps you establish the facts.
We work with lawyers and litigants to understand the legal issues, identify useful evidence sources and agree the scope of examination. The work may support a disputed account, reveal a different explanation or establish that the available evidence cannot resolve it.
Disputed documents & commercial matters
Compare versions, metadata and surrounding activity to assess the history of a disputed record.
Fraud & suspected compromise
Examine available computer traces alongside related records to assess unauthorized access or activity.
Civil litigation & workplace investigations
Preserve relevant records and examine the dates, people and issues within the authorized scope.
FILES, ACTIVITY & DIGITAL TRACES
A computer holds more than visible documents.
Forensic analysis examines the records behind everyday use. These artifacts—traces left by files, applications and the operating system—can help explain what happened and when.
Files & document history
Documents, spreadsheets, photographs and file-system records can help establish what was present, how versions differ and which recorded changes matter. Deleted material may be recoverable, but recovery is never assumed.
Email & messaging records
Available email, attachments, WhatsApp, WeChat and other messaging-app data can connect communications to documents and events. Local records may be incomplete; cloud or phone collections may require separate authority.
Browsing, downloads & cloud activity
Browser history, downloads and available synchronization records can provide context for online activity and file movement. A browser record alone does not establish who was at the keyboard.
External drives & file movement
USB connection records, recent-file entries and matching files on other sources may help reconstruct how information moved. Connecting a drive does not, by itself, prove that files were copied.
Accounts & system activity
Available sign-in, application and system records can help establish a sequence of use or investigate suspected compromise. We distinguish recorded activity from conclusions about a particular person.
Servers, backups & related sources
File shares, virtual disks, backups and authorized account records may preserve another part of the history. A computer image does not automatically include these separate sources.
Availability depends on the device, software, collection method and retention. We report gaps and uncertainties rather than treating missing data as proof that an event did not occur.
FORENSIC IMAGING & PRESERVATION
Preserve the evidence. Examine a working copy.
A forensic image is a documented copy of data read from a hard drive or SSD. Where suitable and readable, a physical image captures file-system structures and storage areas that may retain deleted data—not just the files visible in a folder.
Source drive
Identify the computer, storage and relevant scope.
Preserved acquisition
Create a supported image or collection; document and verify it.
Working-copy analysis
Examine files, system artifacts and related records.
Records & findings
Explain the evidence with traceable, usable deliverables.
The acquisition must fit the computer.
A full physical image is not always possible or appropriate. Encrypted devices or running systems may require a supported live or logical collection. Servers may need a planned collection of virtual disks, shares and logs that also accounts for business operations.
We use write protection where appropriate, document material interactions and acquisition errors, and retain the evidential copy separately from analysis copies. SSD deletion and TRIM can limit recovery even when an image is successfully acquired.
Hash values help detect changes to collected data. They do not prove that every record was captured, that a document is true or who created it. Those require separate analysis.
DEVICE-SPECIFIC ACQUISITION
Different computers need different approaches.
We assess the exact model, operating system, processor, storage and current access before choosing tools and methods. Encryption and device security are part of that assessment, not obstacles we promise to bypass.
Windows computers & laptops
Desktop and laptop drives may support a physical image, an authorized live collection or a focused acquisition. BitLocker, device state and available recovery keys can determine whether collected data is readable.
Apple MacBooks
Intel, T2-equipped and Apple silicon models differ. FileVault, hardware-bound security and storage design may require supported collection on the device itself. Removing a drive does not defeat encryption.
Microsoft Surface Pro
Surface generations differ in processor and storage design; some have removable SSDs. Arm-based models need compatible acquisition software and drivers. We select a supported method for the particular model.
Servers & virtual systems
Virtual disks, file shares, system logs and backups may need separate preservation. We coordinate scope and timing with authorized IT personnel and record any collection limitations.
Preserve access as well as the device.
Ask the client or authorized IT contact to confirm whether the computer is running, locked or encrypted and what has already been done. Advise those holding the device not to reset, update, power-cycle or run recovery tools simply to prepare it for examination. Obtain device-specific preservation advice; coordinate and document any urgent containment. Arrange secure transfer of authorized keys or credentials separately—never through the general inquiry form.
ARTIFACTS & TIMELINE ANALYSIS
Connect the traces. Explain the sequence.
We compare records from different sources, assess alternative explanations and relate the findings to your matter. A timeline is useful when each event has a clear source and meaning—not simply a list of timestamps.
ILLUSTRATIVE ANALYSIS · NOT CASE FINDINGS
File history
Creation, modification and versions
Device records
External storage connections
Application traces
Downloads and available sync records
Correlated chronology
Sequence, source and limitations
Trace a document
Compare files, metadata, recent-file records and relevant destinations to assess a document’s history. The existence of a file is different from proof that it was opened, copied or sent.
Reconstruct relevant activity
Bring available file, account, application and device events together. Explain time zones, clock differences and the meaning of each timestamp before drawing conclusions.
Test an account of events
Assess what supports or contradicts the stated sequence. Distinguish user activity from automated processes, and explain when attribution or intent cannot be established.
CLEAR REPORTS & USABLE RECORDS
Findings lawyers and litigants can use.
We agree the deliverables before work begins and provide expert consultation as the evidence develops. Our reporting gives lawyers and litigants a clear explanation of what the material shows, how it was examined and what remains uncertain.
Selected records
Relevant documents, available email, WhatsApp, WeChat and other messaging-app records, and artifacts organized with source references.
Source-linked chronologies
Focused timelines and schedules that explain the sequence, timestamp basis and important gaps.
Plain-language findings
Clear methods, observations and conclusions supported by the examined evidence. Expert reports and testimony can be scoped where required.
Prepared for scrutiny and court presentation.
Documented acquisition, handling, integrity checks and traceable findings support review and presentation of the evidence. We explain the technical basis and limitations; admissibility is ultimately determined by the court.
PLAN THE EXAMINATION
Start with the matter, the devices and the relevant dates.
We advise on evidence sources, preservation priorities and a proportionate scope for your legal matter. Share the case context and intended deliverables through the contact form; arrange evidence and credential transfers separately.
- The facts or legal issues to be addressed
- Device makes, models and current condition
- Relevant people, dates and data sources
- Authority to access and any privilege restrictions
- Known encryption, available keys and prior IT actions
- The records or reporting you need
PRACTICAL GUIDANCE
What to expect.
Is a forensic image the same as copying a folder?
No. A folder copy usually collects selected visible files. A suitable physical image can preserve additional file-system structures and readable storage areas. A targeted or logical collection can still be appropriate when its scope and limitations are documented.
Can deleted files always be recovered?
No. Overwriting, SSD TRIM, encryption, damage and retention can make records unavailable. We assess the actual source and explain recovery limits rather than promising a complete history.
Do we need to provide passwords or recovery keys?
Authorized credentials or recovery keys can be important, particularly for encrypted devices. We assess access first and arrange a secure transfer method where necessary. Do not send credentials in the general inquiry form.
Will the report establish who used the computer?
Sometimes the records support attribution; sometimes they identify only an account or device. We assess the supporting context and alternative explanations, and clearly state what the evidence does and does not establish.
A PRACTICAL GUIDE FOR LAWYERS & LITIGANTS
Computer Forensics and Acquisition
A concise guide to computer evidence, forensic imaging and preservation, Windows and MacBook acquisition, Surface Pro devices, and the records and reporting that support legal matters.
RELATED ARTICLES
Further reading on computer evidence.
Preservation, document history and the use of digital evidence in legal matters.
YOUR NEXT STEP
Discuss the computer evidence in your matter.
Speak with DFI about the devices, facts and records your matter requires.