Services, Sydney
Security and forensics services in Sydney
Six ways people arrive here, and the twelve services behind them. Every matter is quoted before it starts, and every page below says what it cannot do as plainly as what it can.
- Rate
- $1,000 a day, plus GST
- Scope
- Quoted per matter
- Reply
- Within one business day
- Based
- Emu Plains NSW 2750
Path one
A dispute or an investigation
- For
- Solicitors, insurers, employers, and people who are party to a matter themselves.
- When
- What happened is on a phone, a laptop, a server or a drive, there is a deadline, and somebody on the other side will test how the material was handled.
- You get
- A written report in plain English: what was examined, under what authority, how it was handled, what it shows, and what could not be established.
- First step
- Stop using the device and send the questions that have to be answered, with the date they are due.
Digital forensics
Acquisition, chain of custody, analysis, and a written report for a legal matter.
Phone and computer forensics
Examination of a single handset, laptop or desktop, and what its own records show.
Forensic data recovery
Files recovered from a drive, card or image, with the handling documented as it goes.
Path two
CCTV footage is missing, or is about to be
- For
- Owners, building and strata managers, retailers, warehouses, and anybody who has been asked for footage they cannot produce.
- When
- The clip is not there, or nobody has ever tested whether one can be exported at all. A recorder writes over its oldest footage on a loop, so this path has a clock on it that the others do not.
- You get
- Playable files with a written record of where each one came from, or a written audit of what the system records, keeps and can actually export.
- First step
- Stop the recorder. Power it down or pull the disk, before anything else, including before searching the playback menus for the clip.
Path three
Something may have got in
- For
- Businesses dealing with a breach, a ransom note, a compromised mailbox, or data that has turned up where it should not be. Often alongside an insurer or a lawyer.
- When
- After the event, or once the machines are off the network. Most evidence in a breach is not destroyed by the attacker. It is destroyed by the clean up that follows.
- You get
- The evidence preserved before it is lost, and a written account of what was reached and what was not, in a form a third party can follow.
- First step
- Take the affected machines off the network. Do not wipe, rebuild or restore over the top of them. Then read the list before deciding anything else.
Path four
You want to know what is exposed
- For
- Businesses that want to find the problem before somebody else does.
- When
- An insurer or a customer questionnaire is asking, a board has raised it, something has just happened to somebody nearby, or nobody has ever actually looked.
- You get
- Written findings in priority order, and a fix list your own IT people or your provider can act on without me.
- First step
- Say what the environment is and what you are being asked to prove. Testing is scoped and authorised in writing before anything starts.
Path five
Someone may be tracking or watching you
Unknown devices, repeated password resets or missing documents can leave you unsure where to start. I take the concern seriously and test the technical evidence before reaching a conclusion.
Keep the records before making changes
I identify what needs preserving before a reset or privacy rebuild. I document what has already changed.
Accounts, devices and recovery routes
I map what controls what, including trusted devices and recovery routes. I separate known control from uncertainty.
Wireless observations need context
I record signals and device advertisements. An unfamiliar identifier does not by itself establish tracking or identify a person.
Path six
There is far too much material to read
For solicitors, litigants, insolvency practitioners and businesses in disputes, I organise documents, messages and spreadsheets into searchable material. Each reported finding leads back to a source.
Search across the collection
I ingest documents, scans, photos and exports. OCR and spreadsheet cell indexing help locate material across formats.
Conversations and chronology
I reconstruct available messages and filter by date and participant. I connect findings through a chronology with source references.
Questions another examiner can follow
I prepare technical question registers and reconcile conflicting findings against the underlying records. I document corrections and unresolved items.
How an engagement runs
Work is quoted per matter before it starts. The rate below is what that quote is built from.
Contact
Send the outline, the deadline and the question you need answered. Reply within one business day.
Scope
What is in scope, what is out, and what the deliverable is, agreed in writing before any work starts.
Work
Acquisition, testing or examination, with the handling recorded as it happens rather than reconstructed later.
Report
A written report: what was done, what was found, what it does not cover, and what to do next.
$1,000 a day. All prices are in AUD, plus GST. No hourly rate is published, so no page on this site quotes one.
Questions worth asking before you engage anyone
What does an engagement cost?
Every matter is quoted before work starts, because scope is not knowable until the material is examined. The rate that quote is built from is $1,000 a day, plus GST. That day rate is the only rate published on this site.
How quickly do you reply?
Reply within one business day. Send the outline of the matter, the deadline you are working to, and the question you need answered. If it is urgent, say so in the first line.
Who does the work?
Angus Lewington, trading as Alien Security, ABN 32 385 519 280. One person examines the material and writes the report. There is no reseller between you and the work, and nothing is handed to a third party without telling you first.
Which service do I need?
If the output has to stand up in a legal matter, start with digital forensics. If you want to know how exposed a business is, start with the cyber security audit. If you want systems you own actively tested, start with penetration testing. If footage or files are missing, start with the recovery pages.
Can you certify compliance?
No. A report can describe findings against a framework you name, and that is all it does. It does not certify compliance, and this site claims no accreditation to issue one.
What can you not do?
Overwritten data cannot be recovered, by anyone. A report describes what the evidence shows and cannot promise a legal outcome. Media that has physically failed and needs a cleanroom is referred on rather than opened here.