Phone and computer forensics, Sydney
An examination of a device you own, or hold written authority to examine, run on a copy of it. The report says what the evidence shows, and it says just as plainly what it does not.
- Covers
- Phones, tablets, laptops, desktops
- Output
- A written report, with the image hash
- Area
- Sydney and New South Wales
We examine a device you own, or one you hold written authority to examine, and you will be asked which of the two it is. We do not break passcodes, bypass encryption or get into accounts. If the device is locked and nobody has the passcode, say so at the start, because that changes what is possible before anything is quoted.
What an examination can show
A device records far more about its own use than the screen ever displays. What survives depends on the model, the operating system version and how much the device has been used since.
Messages
Conversations, including deleted rows
Messaging apps keep their history in a database, and deleted entries often sit in it until the space is needed for something else.
Files
Documents and their history
What a file is, when it was created, when it was last opened and changed, and whether a copy of it went somewhere else.
Activity
App and browser use, with times
Which app ran, when, and for how long, alongside browsing and search history the device recorded for itself.
Connections
What was plugged in and paired
USB devices attached, networks joined, and accounts added or removed, each with the time the device wrote down.
Location
Location the device stored itself
Where the device recorded itself as being, at the accuracy it recorded. Not a tracking service, and not somebody else's data.
Deletion
Signs of wiping and clean up
Tools run to clear history, mass deletions, and accounts removed shortly before a device changed hands.
What it cannot show
Said plainly, up front
- It cannot read an encrypted device without the key or the passcode.
- It cannot recover data the device has already written over.
- It cannot reach an account, a cloud backup or a server somebody else controls.
- It cannot tell you who was holding the device. It can say what the device did.
- It cannot promise a legal outcome. It reports what the evidence shows.
What decides how much survives
- Stop using the device. Continued use reuses the space deleted data sits in.
- Do not factory reset it, update it, or hand it to a repair shop first.
- Do not install a recovery app on it. Installing anything writes to it.
- Keep the charger and the passcode with it, and write down who has had it.
- Settle the authority question before anybody touches it.
How an examination runs
Authorise
Ownership or written authority is established first, along with the question the examination has to answer.
Image
The device is copied as far as the device allows, and the copy is hashed. The examination runs on the copy.
Examine
The image is worked through against the question asked, and what is found is tied back to where on the device it came from.
Report
A written report, in plain language, covering what was found, what was looked for and not found, and the limits on both.
What the report contains
- What was examined, and the authority the examination was carried out under.
- How the device was received, handled and stored, and by whom.
- The hash of the image, so what was examined can be checked later.
- What was found, with where on the device each item came from.
- What was searched for and not found, which is often the more useful half.
- The limits: what the method cannot establish, and what the evidence does not say.
The report is written so somebody else can follow it and check it. It does not argue a case and it does not state a conclusion the evidence does not carry.
What it costs
Work is quoted per matter before it starts. The rate below is what that quote is built from.
That rate is $1,000 a day. All prices are in AUD, plus GST.
The first stage is establishing what the device allows, and it is quoted on its own. A locked device, an old operating system or a damaged phone can each change the answer, and none of them is knowable from a description over the phone.
See the rate in fullRelated work
- Digital forensics for the matter an examination sits inside.
- Forensic data recovery when the question is what the media held rather than what the device did.
- Incident response when the device is part of a breach.
Questions asked before a device is handed over
Can you unlock a phone?
No. We do not break passcodes and we do not bypass encryption. If a device is locked and nobody has the passcode, an examination may not be possible at all. Say so when you ask, and you will get that answer before you spend anything.
Can I have somebody else's phone examined?
Only with authority. You need to own the device or hold written authorisation to examine it, and you will be asked which of the two it is. If you are not sure, ask your lawyer before you hand a device to anybody.
Will the device be changed by the examination?
The work runs on a copy. The device is imaged, the image is hashed, and the examination happens on the image. The hash is in the report so anyone can check later that what was examined is what was received.
Can deleted messages be recovered?
Sometimes. Messaging apps often leave deleted rows in their database until the space is needed for something else. Once it is reused the message is gone. Using the phone is what reuses it, which is why the phone should be put away.
Can you tell me who was holding the phone?
No. An examination says what the device did and when the device recorded it. It cannot say whose hand was on it. Any report that claims otherwise is telling you something the evidence does not contain.
What is actually in the report?
What was examined and under what authority, how it was received and handled, the hash of the image, what was found and where on the device it came from, what was looked for and not found, and the limits on all of it.
Can you get into an account or a cloud backup?
No. What can be examined is the device itself and what the device stored. Anything held on somebody else's server is reached through that provider or through a legal process, not through us.
What does it cost?
Work is quoted per matter before it starts. The rate that quote is built from is $1,000 a day, plus GST. The first stage is a look at what the device allows, quoted on its own, because that is what decides the rest.