Casework: what the evidence showed

Casework 01 · Mobile & computer forensics · Expert reporting

Murder, and the phone that knew

Situation. A family lost their son: shot dead outside his home in an Asian country. They came to us not with a legal claim but with the question every family deserves answered: what happened in his last days? They gave us his phone. His employer, to its considerable credit, gave us access to his work computer.

Finding. The devices held the story he never got to tell. A recovered WhatsApp thread showed a stranger warning him away from a young woman he was seeing, in effect: stay away, or else. The warning used a name for her he did not recognise, so he dismissed it as a mistake and told the sender so. The message record, contacts and timeline work indicated that the sender was a person of considerable means, and pointed to a second man we assessed as engaged to act on the threat. A year on, an advertisement placed in the local press seeking information produced photographs of a weapon of an unusual calibre: a calibre matching the ammunition that killed him.

What it changed. Our report, exhibits and timeline were submitted through the deceased's national consulate and moved into diplomatic channels, where the matter rests with the authorities to whom such matters belong. What the family has, and did not have before, is an evidenced account of their son's final days, and proof that the threat he dismissed was real. The phone knew. Our work let it speak.

Identifying details are withheld or altered, and more than a decade has passed since these events. This account is published with the family's consent, held on file. Assessments of individuals are exactly that: evidence-based assessments reported to the proper authorities, not findings of guilt, which belong to courts alone.

Casework 02 · Expert evidence · Document authenticity

The expert who wasn't

Situation. A law firm received forensic reporting from an expert based overseas, retained by the other side. Its conclusions were unfavourable to the firm's client, and the firm wanted a second opinion: on the report, and on the expert.

Finding. The credentials came first, because they invited it: more than a page of certifications, which on verification could not be validated. Those that could be traced resolved to short online courses with no examination attached; nothing established the author as a forensic practitioner in any recognised sense. The report earned the same scrutiny. Its evidential foundation was the metadata of half a dozen PDF files, and the metadata was the report's undoing: the documents' XMP records were inconsistent with the originals they purported to be. Our report set out, item by item, why the conclusions could not stand, and why the underlying files bore the marks of fabrication rather than origin.

What it changed. The opposing report did not survive examination, and neither did the documents beneath it. The complaint was withdrawn. It never reached a courtroom, which is often what a second opinion is for: evidence that cannot stand tends to leave quietly once someone shows why. The matter illustrates the two questions this practice tells every client to ask before instructing anyone: who is the expert, verifiably, and would their method survive another expert's eyes? They are questions we invite about ourselves, in how to choose a firm.

Parties, jurisdictions and identifying details withheld. Findings summarised are those set out in our written report, prepared to the standard proceedings would demand; the complaint was withdrawn without a hearing.

Casework 03 · Cryptocurrency · Criminal defence · Oral evidence

The backup that got there first

Situation. A criminal prosecution arose from a cryptocurrency swap: a substantial quantity of bitcoin exchanged for a large holding of another token. Within weeks the token collapsed to a fraction of its value. The counterparty asked for money back; the defendant declined, on the view that a trade is a trade in both directions. A complaint followed, and the defendant was arrested and spent weeks on remand before bail. On its face, the prosecution's case looked strong.

Finding. The defence had almost nothing: a recollection that the deal had been discussed on an unusual messaging platform specific to the cryptocurrency world, on a phone no longer available, behind a password no longer remembered. With the defendant's authority we reconstructed his password habits and their variations until his own account opened. Inside it sat something he had not known to mention: a backup of the conversation, created long before any complaint existed, held on an international server. Its date was the point: evidence made before the dispute cannot have been made for the dispute. The messages showed a business agreement, and wallet addresses within them corroborated the defendant's account throughout.

What it changed. Our report set out how the evidence was reached, opened and could be independently repeated; the prosecution did not contest it. The work was tested in cross-examination at trial and stood. The defendant was found not guilty. Related civil proceedings continue, so this account is confined to the concluded criminal matter and says no more than the record already does.

Quantities, parties, platforms and jurisdiction withheld or blurred while related proceedings remain live. Access to the account was effected with its owner's authority.

Casework 04 · Counter-surveillance × digital forensics · Hotels

Eight cameras, twenty rooms

Situation. A hotel group's maintenance team found a hidden camera in a suite, by accident. The director of security did not call a sweep company; he called us, because an earlier instruction, a digital forensics and OSINT investigation that identified the perpetrator of an internal fraud, had taught him we could handle the part that matters after the finding: evidential documentation.

Finding. The sweep across twenty rooms found seven more devices: four wired cameras chased into the building's fabric, plastered and painted over, and three wireless quick plants. Each was documented in place before removal. Then the two practices met. In the roof void where recording equipment had sat, a memory card remained, and we did what a sweep company cannot: imaged it forensically and recovered its contents. The card had served before, in another hotel, identifiably not this one from its branding and decoration. And it held an early test recording from the installation itself, in which the installer crossed the frame: the back of a head, a baseball cap, nothing that identifies a person, but everything that proves a practised, travelling operation rather than a one-off intrusion.

What it changed. The operator received what a detection-only engagement could never give: devices documented as evidence, recovered footage establishing the operation's history and method, and a record fit for whatever the group chose to do next. The wider sweep is described at risk3.com; the forensic half is why this entry sits here. One family, both disciplines: the sweep finds the device, the forensics makes it speak.

Operator, locations and dates withheld. The recovered material was preserved under chain of custody and released only to the instructing client.

Casework 05 · Financial markets · Regulatory evidence

The trade that knew too early

Situation. Few accusations move faster or cut deeper in Hong Kong than insider dealing. A firm's traders stood accused of it, and the internal investigation had stalled: forensics across the firm's own systems found nothing. That was the problem, and also the clue.

Finding. Nothing lived on the internal systems because the conversation never happened there. The one place nobody had examined was the Bloomberg terminal, and its recovered messaging told the whole story: a reciprocal arrangement in which traders dealt on one another's accounts, each trading for the other on information the other held, so that no one ever traded on information attributable to themselves. The design of the scheme was its confession: it only makes sense as a way of breaking the link between the knowledge and the trade. The messages, and the account activity they matched, set it out in the traders' own words.

What it changed. The firm was able to take found evidence, not suspicion, to the Securities and Futures Commission and the Hong Kong Monetary Authority, where action followed. The forensic lesson outlives the matter: evidence lives where the conversation lives, and in markets that is as likely to be a trading terminal as a mailbox. An examination scoped only to what IT can see answers only what IT can see.

Firm, individuals, instruments and dates withheld. Findings summarised are those reported to the instructing client and, by the client, to the authorities.

Casework 06 · Leak investigation · Triage at scale

Thirty machines, two answers

Situation. A Hong Kong organisation with public responsibilities believed information had leaked, and the honest answer to "from where" was: any of thirty machines. Examining thirty computers exhaustively would have cost months the matter did not have.

Finding. Triage is a discipline, not a shortcut: the material's handling trail narrows the field before any machine is read in depth. Thirty machines became two, and the two told a complete story. One individual had sent the material to a second, who approved it for its proper purpose. The sender then leaked it. The same trail that authorised the document exposed its leak: the approval was the alibi for one person and the evidence against the other.

What it changed. The organisation closed the matter quickly, with the source established and the innocent party cleared by the same evidence. Speed was the client's requirement and proportionality was how it was met: depth where the trail pointed, and nowhere else.

Organisation, individuals and subject matter withheld. Findings were reported to the instructing organisation for internal resolution.

Casework 07 · Criminal defence · Deleted data recovery

Deleted, not gone

Situation. A young man faced a serious criminal allegation. The defence instructed us to examine a forensic image that was itself a police exhibit: the material was lawfully in the process, and the question was whether it held anything the first examination had not surfaced.

Finding. It did. Recovery of deleted WhatsApp content produced messages exchanged between the complainant and a friend before the report was made, discussing what would be said and how the matter would be reported. We recovered them, documented how, and reported them exactly as found: no characterisation, no argument, the messages themselves, in their own words.

What it changed. Following disclosure of the recovered material, the case was discontinued. A young man kept the rest of his life, without a criminal record. The practice point is the one this firm repeats most: deleted is not gone, an expert's duty runs to the evidence rather than to either side, and the same examination that can convict is the examination that can clear.

This entry concerns an allegation of a sexual offence in a matter that is historic. The complainant's anonymity is absolute and protected by law; every identifying detail is withheld, including jurisdiction and any dates or timing, and the messages are described only to the extent necessary to explain the forensic work. Reviewed and approved by counsel prior to publication.

Casework 08–09 · In preparation

The invoice that changed banks (business email compromise) · The weekend with two hundred custodians (eDiscovery at scale). Each publishes after sanitisation review.