Digital forensics and evidence, Sydney
Digital forensics for solicitors, businesses and individuals who need evidence they can check. I examine the whole environment together: computer, phone, accounts, network, wireless and deleted material. The findings come back in plain English.
- Based
- Emu Plains NSW 2750
- Examiner
- One person, start to finish
- Scope
- Written before work starts
- Handling
- Imaged, hashed, recorded
- Rate
- $1,000 a day, plus GST
What has happened?
Eight ways people arrive here. All of them end in a written record of what was examined, what it shows, and what could not be established.
A dispute or an investigation
What happened is on a phone, a laptop or a server, and somebody on the other side will test how it was handled. Examined on a copy, custody recorded from the handover on.
CCTV footage is missing
The clip you need is not there, and the recorder is probably still running and writing over it. This is the urgent one. Stop the unit first, then read this.
Something may have got in
A breach, a ransom note, or an account nobody recognises. What is done in the first hours decides what can be proved later, and most evidence is lost to the clean up.
You want to know what is exposed
An insurer, a customer questionnaire, a board or a bad feeling. An audit of what is actually reachable, and testing by hand against it, before anything happens.
You no longer control your accounts
I preserve evidence, map accounts and devices, and test concerns about access, tracking or disappearing information.
Wireless keeps dropping out
I investigate interference, record the RF environment and compare changes. A detected signal does not identify a person.
There is too much evidence to read
I make documents, messages and spreadsheet cells searchable, with findings traced back to source records.
You do not know which of these it is
Bring the whole problem. I work out which parts of the computer, phone, accounts, network and wireless environment can answer the question.
Bring me the whole problem.
You do not need to choose a technical discipline before making contact. I identify the questions, preserve what matters and work through the evidence across the environment.
Eight stages, one investigation
Understand, Preserve, Analyse, Correlate, Explain, Recover, Secure, Handover.
The lab behind the work
My workshop brings together computers, storage, networking, radio and test equipment accumulated over more than twenty years.
The right scope for the question
I distinguish in house capability, specialist engagement needing preparation, and partner or escalation work with material prepared for handover.
A concern taken seriously
I test what can be tested and explain what remains unknown. You do not need to know what kind of specialist you need before contacting me.
Method, in place of promises
This site carries no client names and no case studies. What it can show you is how the work is done, and where it stops.
The work runs on a verified copy
Where it is technically possible the device is imaged first, the image is hashed, and every examination after that runs on the copy. Some phones and some live systems cannot be copied that way. Where touching the source cannot be avoided, it is kept to the minimum and written down, so how the material was handled can be read alongside what it showed.
Read about phone and computer forensicsTesting by hand, not just a scan
A scanner lists what it recognises. The finding that matters is usually the path that joins two small problems into one way in. That part is done by hand.
Read about penetration testingThe recorder is already writing over it
A CCTV recorder writes over its oldest footage on a cycle. Once a frame has gone, it has gone. Footage is looked at first for that reason, not for a better one.
Read about CCTV footage recoveryThe scale of one matter
Figures from real engagements, rounded and anonymised. They describe the size of the work, not a result to expect.
500,000+
Chat messages made searchable
In one matter, recovered and made searchable. Rounded figure.
75,000+
Documents in a searchable evidence set
In one matter, the indexed collection grew past this figure. Rounded.
1,400+
Deleted items recovered
In one matter, including several hundred court documents. Rounded figure.
150+
Technical questions answered
In one matter, for an external reviewer and the client's lawyers. Rounded.
Contact. Preserve. Examine. Report.
The order is the point. Preservation happens before anyone goes looking, because looking can change the thing you need.
Contact
Tell me what happened and what you need to prove. If a retention cycle is running, say that first.
Preserve
Where the device allows it, it is imaged before it is examined, the image is hashed, and the handover is recorded.
Examine
The examination runs on the copy. Any interaction with the source that could not be avoided is recorded too, with the findings, including what cannot be established.
Report
A written report in plain English: what was examined, what it shows, and where the limits sit.
Evidence does not care who is paying for the report.
The rate is on the page
Work is quoted per matter before it starts. The rate below is what that quote is built from. Reply within one business day.
Stage one
Say what happened
The device or the system, what it has to prove, and the date anything is due. That is enough to say whether this is the right service at all, and what the first stage would involve. Reply within one business day.
Stage two
Preserve and look, quoted on its own
The first stage establishes what the device or the media actually allows. It is quoted separately and before the examination, because until it is done nobody can size the rest of the work honestly, including me.
Stage three
Examine and report
Once the first stage has said what is there, the examination and the written report are quoted. The quote states the number of days before anything starts.
$1,000 a day, plus GST, is the rate all three stages are billed from. Work is done by Angus Lewington, from Emu Plains NSW 2750. All prices are in AUD, plus GST.
Examination, recovery, analysis and reporting are all billed at this one rate.
Limits
What this cannot do
Better read here than found out at your expense.
Overwrite
Overwritten data does not come back
Where new data has been written over the old, no tool recovers it. An examination can establish that it happened. Nothing undoes it.
Retention
The clock on footage is real
A recorder writes over its own oldest footage on a cycle. Past that point there is nothing left to recover, whoever you ask.
Outcome
A report is not a result
A report says what the evidence shows and what it does not show. It cannot promise how a matter ends, and one that does is worth less under challenge.
Cleanroom
Physically failed drives go elsewhere
A drive with head or motor damage needs a cleanroom. There is not one here, so that work is referred on rather than attempted.
If it is already happening
Two things worth doing before you call anyone
Stop the recorder
A DVR writes over its oldest footage to make room. While it runs, the thing you need is being consumed. Power it down or pull the disk, and do it before you go looking through the playback menus.
What to do nextTake it off the network, do not rebuild it
Unplug the cable or switch off the wireless. Do not wipe it, do not restore a backup over the top, and do not run a cleaner across it. Most evidence in a breach is not destroyed by the attacker. It is destroyed by the clean up.
The full list, in orderQuestions people ask first
What does it cost?
$1,000 a day, plus GST. Work is quoted per matter before it starts, so you agree to a number before anything begins. No hourly rate is published, because none was set.
My CCTV footage is a few days old. Is it too late?
It may be. A recorder writes over its own oldest footage on a retention cycle, and once a frame has been written over it is gone. No tool brings it back. If the recorder is still running, taking it out of service stops the overwrite, and that is the one thing worth doing before you call anybody.
Can deleted files be recovered?
Sometimes. Deleted usually means the pointer to the data was removed while the data itself is still on the disk. Overwritten means the data is gone. The examination tells you which of the two you have, and the report says so plainly either way.
Will the report help me win?
A report describes what the evidence shows, and what it does not show. It cannot promise how a matter ends, and I will not write one that pretends to.
Who does the work?
Angus Lewington, sole trader, ABN 32 385 519 280, based at Emu Plains NSW 2750. One person images the device, examines it, and writes the report. Nothing is handed on to a reseller.
Do you open drives that have physically failed?
No. A drive with head or motor damage needs a cleanroom, and there is not one here, so that work is referred on rather than attempted. If a drive is clicking or will not spin, stop using it and say so when you make contact.
I just want my family photos back. Is this the right place?
Probably not. This is recovery where the output has to work as evidence: a forensic image, a hash, a record of who held the device, and a written report. If nobody will ever have to defend how the files came back, you are paying for paperwork you do not need.
How fast do you reply?
Within one business day. If a retention cycle is running on footage, put that in the first line of your message and it gets read first.