Digital forensics · Incident response · Cyber readiness
Contact DFI

Digital Forensics

Turn collected data into reviewable evidence.

We help your legal team turn collected data into material they can review and use. Working to agreed instructions, we support collection, processing, search, and organized evidence production.

Plan a production

UNDERSTAND THE EVIDENCE

Build a reviewable record and a production you can explain.

An export is useful only if the legal team understands what it contains, what it excludes and how it was prepared. We support the technical work of collecting, processing, searching and organising digital material under agreed instructions, while counsel retains responsibility for legal review and disclosure decisions.

01 / THE EXAMINATION

Separate the stages and responsibilities

Preservation protects potential evidence; collection captures agreed material; processing prepares it for review; legal review determines relevance, privilege and disclosure; production delivers the approved set in an agreed form. Treating these as separate decisions makes it easier to identify an omission and decide who must resolve it.

The protocol should state who can approve changes. A decision to expand the date range, alter duplicate handling or omit an unsupported category may materially change the review population. Keeping these decisions visible is more useful than presenting a large export as though its contents were self-explanatory.

02 / THE EXAMINATION

Define the population before searching it

We work with counsel to identify custodians, sources, dates and known gaps. The source map should include attachments, linked files, shared locations and any relevant material already collected by others. A well-executed keyword search cannot find a source that was never included.

Existing exports require the same scrutiny as newly collected material: who made them, from which sources, using which filters and with what exceptions? We preserve that distinction in the source record. An inherited folder of documents should not be labelled a complete mailbox or device collection without evidence of its coverage.

03 / THE EXAMINATION

Make processing exceptions visible

Encrypted, damaged, unsupported or poorly indexed files should not silently disappear from the review. We discuss text extraction, OCR, duplicate handling, date fields and family relationships, and identify material exceptions. OCR can help search scanned documents, but searchable text still needs testing against the image.

Duplicate reduction should be designed around the question. A review team may need to know that identical content appeared in several custodians’ collections or as different attachments. Near-duplicates are not necessarily identical. The chosen approach should retain the agreed context and allow reviewers to understand what was suppressed from their view.

04 / THE EXAMINATION

Test the search rather than trust the hit count

Search terms need context: names and aliases, project language, spelling variants, dates and the fields being searched. We document the agreed queries and assess practical checks such as known relevant items and representative results. Counsel decides what further review is appropriate; a hit is not automatically relevant and a non-hit is not automatically irrelevant.

Quality checks should consider both what the search returns and what it may miss. An expected document that does not appear can reveal a source omission, field-selection problem, spelling issue or indexing failure. That information should lead to a documented correction or limitation, not simply a lower hit count.

05 / THE EXAMINATION

Agree the production before the final export

Native files, rendered PDFs or images, searchable text and metadata/load files serve different needs. We confirm the receiving format, identifiers, attachment treatment, redaction instructions and delivery requirements. A final reconciliation should explain how the approved review set became the delivered set and identify unresolved exceptions.

A useful handover includes the production manifest and the information needed to open or load the files, not merely a download link. Where redactions are instructed, the delivered form and accompanying text or native files must be checked for unintended disclosure. Counsel approves the set and the legal treatment before release.

RELEVANT SOURCES

Follow the evidence across the relevant sources.

The useful sources depend on the question, lawful scope and what remains available. Collection and examination are agreed for the particular matter.

Collected documents

Native office files, PDFs and other supported records form the starting population. Their source identifiers and original relationships should survive processing.

Mailbox collections

Messages and attachments need coordinated treatment so a search or export does not unintentionally separate the communication from its supporting document.

Mobile and messaging exports

Conversation boundaries, participants, attachments and available metadata affect how the material can be reviewed and produced.

Cloud-linked material

A message may contain a link rather than the underlying file. Collection authority, the relevant version and supported export options need to be agreed.

Processing and search records

Exception lists, query versions and production manifests help explain omissions, transformations and the scope of the delivered material.

HOW WE WORK

A defined question. A documented examination.

We connect the scope, sources and methods to the result you need, with the limits of the evidence made clear.

  1. Set the protocol

    Agree sources, date treatment, roles, review requirements and the intended receiving format.

  2. Process and reconcile

    Prepare supported data, preserve relationships and identify errors or items needing special handling.

  3. Search and support review

    Apply documented criteria and QA checks; route legal decisions to counsel.

  4. Produce and verify

    Export the approved set and check identifiers, counts, attachments, readability and agreed supporting files.

BEFORE WE BEGIN

Give us the context. Preserve the source.

A clear first discussion helps us identify a useful scope. Use the contact page for an initial inquiry, not to upload evidence or credentials.

  • Identify custodians, sources, relevant dates and any missing or inaccessible data.
  • Provide search instructions and clarify who approves relevance, privilege and redactions.
  • Identify the receiving platform or production specification.
  • Explain the deadline, prior productions and any required identifiers or load-file fields.

COMMON QUESTIONS

Understand the limits
before you begin.

Does a keyword search identify everything relevant?

No. Search effectiveness depends on source coverage, extracted text, syntax and the way people describe the subject. Queries should be tested and revised where the results reveal gaps. Legal review remains necessary.

Should duplicate files simply be deleted?

Not without an agreed method. Identical content can occur in different custodians or locations. Duplicate handling should preserve the context needed for review, including the agreed record of where copies were found.

Can everything be produced as PDF?

A PDF may be suitable for some material, but can omit useful native functionality or information. Spreadsheets, databases and linked content may need different treatment. The production format should be agreed for the matter and receiving system.

Who decides relevance and privilege?

Counsel or the instructed legal review team. DFI supports the technical workflow and implements agreed instructions; processing, search hits and automated classifications do not replace those legal judgments.

Technical references and further reading

General educational guidance. Source-specific capabilities and available records require assessment; legal authority and procedure should be addressed with counsel.

YOUR NEXT STEP

What do you need to understand?

Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.

Plan a production
Explore all digital forensics services