Digital forensics · Incident response · Cyber readiness

Digital Forensics

Establish what may remain.

Assess deleted or unavailable material as part of a scoped forensic inquiry, without promising universal data recovery.

01

Identify the source and the loss.

Explain the type of device, relevant files, deletion or failure circumstances and any subsequent use. This helps distinguish a forensic question from a general repair or recovery request.

02

Consider available alternatives.

A surviving backup, related account, exported record or another authorized device may be relevant. The useful source need not be the device on which the problem was first noticed.

03

Agree feasibility before broad claims.

Assess the available methods and limitations before defining an examination. Some sources may require a specialist recovery provider rather than DFI’s forensic investigation service.

RELEVANT SOURCES

Start with what is available.

Discuss the sources that can help answer the question, within an authorized scope.

Supported devices and storageAvailable backups and account copiesRelated authorized evidence sources

BEFORE WE BEGIN

A more useful first conversation.

  • Describe what is missing and when.
  • Identify subsequent device use if known.
  • Seek tailored advice before attempting repair or recovery.

YOUR NEXT STEP

What do you need to understand?

Tell us what you need to understand.

Assess suitability