Digital forensics, Sydney
Digital forensics for legal matters
A device is acquired, hashed and examined on a copy. What it showed, and how it was handled, come back as a written report you can put in front of the other side.
- Output
- A written report
- Method
- Analysis on a verified copy
- Rate
- $1,000 a day, plus GST
- Reply
- Within one business day
Acquire. Preserve. Analyse. Report.
The order matters more than the tooling. Each step is recorded as it happens, not written up from memory afterwards.
Acquire
A copy is taken from the device or media. The copy is hashed, and the hash is recorded before anything is opened.
Preserve
The original is set aside and not used as the working surface. Who held what, and when, is written down at each handover.
Analyse
Work runs on the copy: file systems, deleted space, timestamps, logs and the artefacts the system kept about itself.
Report
Findings in writing, with observation kept separate from inference, and the method described well enough to be checked.
What the report contains
The report is the deliverable. It is written to be read by a solicitor, argued with by another examiner, and understood by the person who has to make a decision from it.
What was examined
Each item, how it arrived, its identifiers, and the hash of the copy the work was done on.
How it was handled
The chain of custody: every transfer, every step taken, and the date and time each one happened.
What the evidence shows
The findings themselves, with the artefacts they rest on named, so another examiner can go and look at the same thing.
What it does not show
The gaps: what was out of scope, what could not be read, and where the evidence stops short of the question asked.
The limits, before you commission anything
Forensics is a search. It is not a guarantee. These limits apply to this work and to anyone else who does it honestly.
Overwritten data cannot be recovered. Deleted often means reusable rather than erased, so a file may still be there. Once the space has been written over, it is gone.
A report describes what the evidence shows. It cannot promise a legal outcome, and no examiner can tell you in advance what a court will make of it.
Media that has failed physically and needs a cleanroom is referred on. It is not opened here, because a bad first attempt makes the next one harder.
Who does the work, and what it costs
One person examines the material and writes the report, so the person who signs it is the person who did it. Every matter is quoted before work starts, from a rate of $1,000 a day. All prices are in AUD, plus GST.
Reply within one business day. Bring the deadline with you: court and tribunal dates change what is worth doing first.
Questions solicitors ask first
What do you need from me to start?
The device or an image of it, whatever you know about how it was handled, and the questions you want answered in writing. Reply within one business day.
How is the evidence handled?
The original is not the working surface. A copy is taken, its hash is recorded, and the analysis runs on the copy. Every transfer and every step is written down, so the record of handling can be read alongside the findings.
Can you recover deleted files?
Sometimes. Deleted usually means the space was marked reusable, not erased, so if nothing has reused it the data is often still there. If it has been overwritten, it is gone, and no tool changes that.
Will the report say who did it?
It says what the evidence shows and when it happened. Tying an account or a device to a person is an inference drawn with the rest of the case. The report keeps what was observed separate from what is inferred, so the reader can see which is which.
What if the drive is physically broken?
Media that has failed physically and needs a cleanroom is referred on. Opening a failed drive outside one usually makes the next attempt worse, so it is not attempted here.
What does a forensic examination cost?
The matter is quoted before work starts. The quote is built from a rate of $1,000 a day, plus GST, covering acquisition, analysis and the written report.