Digital forensics, Sydney

Digital forensics for legal matters

A device is acquired, hashed and examined on a copy. What it showed, and how it was handled, come back as a written report you can put in front of the other side.

Output
A written report
Method
Analysis on a verified copy
Rate
$1,000 a day, plus GST
Reply
Within one business day

Acquire. Preserve. Analyse. Report.

The order matters more than the tooling. Each step is recorded as it happens, not written up from memory afterwards.

  1. Acquire

    A copy is taken from the device or media. The copy is hashed, and the hash is recorded before anything is opened.

  2. Preserve

    The original is set aside and not used as the working surface. Who held what, and when, is written down at each handover.

  3. Analyse

    Work runs on the copy: file systems, deleted space, timestamps, logs and the artefacts the system kept about itself.

  4. Report

    Findings in writing, with observation kept separate from inference, and the method described well enough to be checked.

What the report contains

The report is the deliverable. It is written to be read by a solicitor, argued with by another examiner, and understood by the person who has to make a decision from it.

Scope

What was examined

Each item, how it arrived, its identifiers, and the hash of the copy the work was done on.

Custody

How it was handled

The chain of custody: every transfer, every step taken, and the date and time each one happened.

Findings

What the evidence shows

The findings themselves, with the artefacts they rest on named, so another examiner can go and look at the same thing.

Gaps

What it does not show

The gaps: what was out of scope, what could not be read, and where the evidence stops short of the question asked.

The limits, before you commission anything

Forensics is a search. It is not a guarantee. These limits apply to this work and to anyone else who does it honestly.

Overwritten data cannot be recovered. Deleted often means reusable rather than erased, so a file may still be there. Once the space has been written over, it is gone.

A report describes what the evidence shows. It cannot promise a legal outcome, and no examiner can tell you in advance what a court will make of it.

Media that has failed physically and needs a cleanroom is referred on. It is not opened here, because a bad first attempt makes the next one harder.

Who does the work, and what it costs

One person examines the material and writes the report, so the person who signs it is the person who did it. Every matter is quoted before work starts, from a rate of $1,000 a day. All prices are in AUD, plus GST.

Reply within one business day. Bring the deadline with you: court and tribunal dates change what is worth doing first.

Questions solicitors ask first

What do you need from me to start?

The device or an image of it, whatever you know about how it was handled, and the questions you want answered in writing. Reply within one business day.

How is the evidence handled?

The original is not the working surface. A copy is taken, its hash is recorded, and the analysis runs on the copy. Every transfer and every step is written down, so the record of handling can be read alongside the findings.

Can you recover deleted files?

Sometimes. Deleted usually means the space was marked reusable, not erased, so if nothing has reused it the data is often still there. If it has been overwritten, it is gone, and no tool changes that.

Will the report say who did it?

It says what the evidence shows and when it happened. Tying an account or a device to a person is an inference drawn with the rest of the case. The report keeps what was observed separate from what is inferred, so the reader can see which is which.

What if the drive is physically broken?

Media that has failed physically and needs a cleanroom is referred on. Opening a failed drive outside one usually makes the next attempt worse, so it is not attempted here.

What does a forensic examination cost?

The matter is quoted before work starts. The quote is built from a rate of $1,000 a day, plus GST, covering acquisition, analysis and the written report.

Send the matter through and get a scope back.