Preservation is the step you cannot redo.
Everything else in a digital evidence matter can be repeated. Acquisition cannot. We create verified, bit-for-bit images of devices and cloud data, with custody documentation that closes the argument before it starts.
Why imaging is the foundation
A forensic image is a complete, verified copy of a device or data source, fixed with cryptographic hashes at the moment of acquisition. From that point, every examination happens on the copy; the original sits untouched, and any expert on any side can confirm the copy is faithful. Matters are lost at this step more often than any other: a laptop someone booted to have a look, a phone that kept syncing, a mailbox export done casually with no record of how.
Our custody documentation records every hand the evidence passes through, every action taken and when. It reads as dry paperwork right up until the moment opposing counsel goes looking for a gap and does not find one.
What we acquire
- Windows and Mac computers, laptops and servers.
- iPhone and Android devices, with condition and access assessed first.
- External drives, USB media and legacy storage.
- Mailboxes, Microsoft 365 and Google Workspace tenancies, and cloud storage.
Frequently asked
- Can imaging be done on our premises?
- Yes. On-site acquisition is routine where devices cannot leave the building, including out-of-hours work so operations are not disturbed. The custody record is identical either way.
- What does a chain of custody document actually record?
- Who collected the item and from whom, every transfer and handling event, the hashes fixing the data's state, and the storage conditions between events. Its purpose is simple: no unexplained interval an opponent can exploit.
Speak to the consultant who will run the work
Instructions are led by Alan Jeffries, Principal Consultant. The first discussion is confidential, carries no fee, and often changes what a client decides to do next. Call +852 5808 1071, message us on Signal, or use the case review form.
Every engagement runs under the DDD Method: Detect. Document. Demonstrate.