01
Hardware
Computers, servers, network and peripheral equipment, storage. Condition, configuration, serviceability, reasons a medium cannot be read.
Read more
Digital traces
speak for themselves
DFE — court-ordered and private computer forensic expertise. We reliably extract, examine and explain digital evidence for courts, investigators and business.
01Digital Forensic
Expertise
Computer-technical expertise is a discipline of its own. We examine hardware, software, data and networks so that every conclusion holds up in court, under expert cross-examination and in a repeat examination.
01
Task and materials
We study the questions, the scope of the work and the documents.
02
Intake and imaging
We log the objects, take a bit-for-bit copy and verify the hash.
03
Examination
Artifacts, logs, metadata, software, networks, correspondence.
04
Report
Answers to the questions posed, methodology and appendices.
05
Handover and testimony
Delivery of results, peer review, appearance at the hearing.
02
Types of expertise
02
Software
Operating systems, applications, 1C, websites, databases, source code. Composition and settings, signs of counterfeiting, malicious functions and code changes.
Read more
03
Data
Search and analysis of files, logs and metadata. Creation, modification and deletion dates, traces of copying and tampering, data recovery.
Read more
04
Network
Network tools and internet technologies: connections, accounts, email, cloud services, traces of unauthorized access.
Read more
05
Mobile devices and messaging
Smartphones and tablets, messengers, email, calls, geodata, deleted records and a timeline of actions.
Read more
06
Multimedia and deepfakes
Photo, audio and video: signs of editing or neural generation, analysis of metadata, compression artifacts, lighting and proportions.
Read more
07
Spec compliance and IT product value
Checking delivered work and AI products against the technical specification, estimating development cost.
Read more
08
Review of an expert report
Independent review of a finished report: completeness, methodology, soundness of conclusions. No new examination is performed.
Read more
09
Court and private
On a court ruling or investigator’s order, or under a contract with the client when a report is needed before going to court.
Read more
03
Methodology
SHA-256Integrity control at every stage of handling the object
Read-onlyWe examine copies only; the original is protected by a write blocker
ReproducibilityAny conclusion can be repeated and independently verified
ConfidentialityCase data stays inside a protected perimeter
04
We apply forensic methods and tools of digital forensics to reconstruct events from digital traces and explain them without guesswork.
Imagebit-for-bit copy of the object
Timelineevent reconstruction
Findinganswers to the court’s questions
05
How we
work
From data source to report: every step is documented and every action on the object can be verified. The result is a report fit for court, investigators and internal inquiries.
06
Methods and objects
Classical methods
- Bit-for-bit images of media, integrity control
- Recovery of deleted data with regard to the medium, including SSD and TRIM limits
- Metadata analysis: dates, authorship, signs of forgery
- Event log analysis and a timeline of user actions
- Keyword and signature search
Modern methods
- eDiscovery: search across large datasets with machine learning
- Source code analysis: vulnerabilities and malicious elements
- Reverse engineering of software without source code
- Analysis of network activity and attack traces
- Neural-network methods for detecting editing and generation
Objects of examination
- Computers, servers, network equipment, storage
- Smartphones, tablets, IoT devices
- Operating systems, applications, databases, 1C, websites
- Files, logs, correspondence, multimedia
- Cloud services and accounts
07
How to engage
Court-ordered
The basis is a court ruling or an investigator’s order. Prepare the procedural document and case materials; we will go through the list of questions with you.
Private engagement
We work under a contract. Describe the situation and goal: preparing for a dispute, an internal investigation, a software audit, a review of someone else’s report.
What to prepare
- Devices, media, files or databases
- Technical specification, contracts, acts, specifications
- System logs, backups, correspondence, screenshots
- Information on usage and on actions taken after the event
The expert establishes technical facts. Legal qualification and guilt are not assessed.
08
08
Frequently asked questions
It is the examination of computing equipment, software and data by a specialist with the relevant expertise. The expert establishes technical facts: what is stored on a medium, when and how data changed, how software is built and how it works. Findings are set out in a report.
A court expertise is ordered by a court ruling or an investigator’s order. A private one is carried out under a contract with the client: to assess positions before a trial, prepare evidence or check someone else’s report.
What is the condition and configuration of the equipment, what software is installed, are the required files on the medium, which creation and modification dates can be established, was anything deleted, copied or tampered with, what is the technical cause of a failure, was a file created with AI.
No. The expert establishes technical circumstances and does not answer legal questions. Weighing evidence and findings on guilt belong to the court and investigators.
Do not install programs or delete files, preserve the current state and any error messages, and do not try to “fix” the device. It is best to agree the copying and handover procedure with the expert in advance.
No. The original is connected through a write blocker, a bit-for-bit copy is taken and its integrity is confirmed by a checksum. All further work is done on the copy only.
Signs can be found: metadata inconsistencies, traces of recompression, broken perspective, shadows and lighting. Neural-network methods complement manual analysis but do not replace it, and we always assess the reliability of a finding separately.
On the number of objects, the volume of data, the number and complexity of the questions and the type of engagement. We give an exact estimate after a first discussion of the task and a look at the materials.
09
Need an
expertise?
Describe the task and we will come back with a work plan, timing and cost.