Digital forensics examines available records to answer a defined question: what happened, which systems or accounts were involved, and what the evidence can support. TRUST-IT works with businesses, legal advisers and authorised individuals on incidents, internal investigations and disputes involving computers, mobile devices, email and cloud records.
Authorised scope and evidence preservation
We first agree the investigation questions, relevant devices or accounts, authority to examine the data, and any handling restrictions. A focused scope helps distinguish useful evidence from unrelated personal or business information.
Depending on the source and agreed scope, collection may include forensic images, device data, email exports, audit logs and relevant files. We document collection methods, integrity checks such as cryptographic hashes where applicable, and the chain of custody. The report records gaps, unavailable sources and technical constraints rather than implying that every record can be recovered.
For device-specific examination, see our computer and mobile forensics services.
Reconstructing events and investigating incidents
Email messages, account activity, document metadata and relevant communication records can help reconstruct events involving suspected fraud, social engineering or unauthorised access. We compare sources within the agreed scope and distinguish observed activity from assumptions.
Investigator reconstructing a social engineering incident with telephone records and interview notes. Timeline analysis considers timestamp formats, time zones, logging coverage and conflicting records. An action associated with an account or device does not, by itself, establish who performed it. Findings state the supporting artefacts, alternative explanations and limits of attribution.
Where an active security incident also requires containment or service restoration, forensic examination is coordinated with the incident team. Response arrangements and availability are agreed for the engagement. See incident response and forensic investigation for this related scope.
Technical reports, expert support and eDiscovery
Reports connect the investigation questions to collection methods, relevant artefacts, analysis, conclusions and limitations. Technical explanations are written for the intended audience, including internal decision-makers and legal advisers, with sufficient detail to review the basis of each finding.
For disputes involving larger sets of electronic records, eDiscovery and litigation support can cover identification, preservation, collection and preparation for review under an agreed protocol. The scope determines the sources, custodians, date ranges and deliverables.
Digital evidence specialist preparing a neutral technical explanation at a document camera station. Expert support explains technical findings and their limits; it does not guarantee admissibility, a court decision or the outcome of a case. Recovery depends on the condition of the source, available access and the evidence that remains.
Discuss your evidence question
Tell us the type of matter, the devices or records involved and the question you need answered. Do not send passwords or sensitive evidence through the public form. Request a confidential scoping discussion so we can agree the appropriate next step and a suitable channel for any evidence transfer.
Define the evidence question before examination
An examination might need to establish a sequence of activity, assess information movement or compare evidence from several devices. The useful starting point is the question and authorised scope, not an assumption that every recoverable file is relevant. Device condition, encryption, time elapsed and previous handling influence the available options.
We agree the collection and reporting approach with the commissioning team, including who may receive sensitive material. Findings should distinguish observations, interpretation and unanswered questions. Where a matter extends into email, cloud accounts or a legal review process, those sources and responsibilities can be planned as connected workstreams.
Explore the detailed service scope
Computer, mobile & digital media forensicsEmail, Microsoft 365 & cloud forensicseDiscovery & technical litigation supportAlready have a forensic report?
Reviewing an existing report is a distinct task. Our guide explains what can be checked from the report alone, when underlying evidence is needed and how to scope an independent technical assessment.
Read the practical guide