Straight answers about digital evidence

By Alan Jeffries, Principal Consultant, D3Forensics Limited

The questions people actually ask, answered the way we answer them on the phone: plainly, with the limits stated. Each answer is general information, not advice on your matter; the free first conversation is where your facts get their own answer.

Can deleted WhatsApp messages be recovered?

Often, from the device's database, its backups or the counterpart's copy, provided the phone stopped being used soon after deletion and there is lawful authority to examine it. Success depends on platform, time elapsed and overwriting; feasibility is assessed honestly before any fee.

An employee has left and we think they took data. What now?

Preserve first, investigate second: take their computer, phone and accounts out of circulation, suspend deletion policies, and do not let IT tidy up. The evidence of what left, when and to where usually survives if nothing is touched, and is destroyed by well-meaning cleanup.

Is it lawful to examine an employee's work device in Hong Kong?

Generally yes where the employer owns the device and has established policies, but PDPO obligations and proportionality still apply, and personal accounts on a work device need care. We work with your counsel on the lawful basis before examination begins.

Can you get into a locked phone?

Sometimes. A passcode widens access dramatically; without one, options depend on make, model and software version, and we say plainly which category yours falls into before any fee is incurred rather than promising what a locked device may not give.

How quickly must a mailbox be preserved after an incident?

Immediately. Microsoft 365 and Google Workspace retention windows and audit logs expire on schedules measured in days to months, and attackers and departing employees both delete traces. Preservation can start the same day you call.

Can deleted emails be recovered?

Frequently: platforms hold deleted items for a period, litigation holds and Vault hold more, and local files and backups hold more still. What survives depends on settings and time, which is why the first call should come before the cleanup.

Will forensic evidence stand up in a Hong Kong court?

It will if it was preserved and examined properly: verified copies, documented chain of custody, repeatable method, and reporting aligned with Order 38 and the Code of Conduct for Expert Witnesses. Evidence handled casually before we arrive is the usual point of attack.

Can you tell if a document or email has been backdated?

Usually, given the right material: metadata, system records, server logs and internal consistency tend to betray fabrication. Where the material is insufficient to say, we say that too, which is precisely why courts can rely on the finding when we can.

What does digital forensics cost in Hong Kong?

It depends on devices, their condition, the question and urgency, and it is fixed in writing before work begins. Feasibility is free. The full structure is published at how forensic fees work, because guessing helps nobody.

Can a private individual instruct a forensic examiner?

Yes, for devices and accounts you own or control: your phone, your computer, your mailbox. We do not examine other people's devices or accounts without lawful authority, and enquiries seeking that are declined.

Related: choosing a firm · how fees work · the glossary · all services