Digital investigations. Evidence that brings clarity.
A suspicious payment, compromised account or disputed digital record? Start with the question you need answered. We agree the authorised sources and examine what the evidence can establish.
Scope, deliverables and fees agreed before work begins.
Your question
What happened, what was accessed or which records can clarify a dispute?
The investigation
Agreed sources, documented handling and analysis within an authorised scope.
Your deliverables
A supported timeline and technical findings with explicit limitations.
Digital forensics expertise
Registered digital evidence experts
TRUST-IT has digital evidence experts and examiners registered on the expert rosters of the Athens Court of First Instance and the Public Prosecutor’s Office at the Athens Court of First Instance.
Discuss your matterWhat do you need to establish?
An incident is happening
Coordinate containment, evidence and recovery with the responsible incident lead.
Explore the approach02 /An account or payment looks wrong
Reconstruct email and cloud activity around the reported event.
Explore the approach03 /A sensitive allegation needs facts
Define a confidential, proportionate corporate investigation.
Explore the approach04 /A dispute needs electronic evidence
Prepare traceable collection and technical support for legal review.
Explore the approachFor an active security incident, call +30 210 652 0660. Agree a secure channel with the team before sharing evidence or sensitive information.
Follow the evidence.
Across the digital environment.
Incident response & forensics
Investigate incidents with structured evidence collection, clear timelines, and practical recovery recommendations.
Explore service
Computer & mobile forensics
Forensic examination of computers, phones, storage media and backups, with documented acquisition, timelines and evidence limitations.
Explore service
Email & cloud investigations
Investigations across Microsoft 365, Google Workspace and cloud environments, including business email compromise, access and data sharing.
Explore service
Corporate & insider investigations
Confidential technical investigations into suspected insider activity, IP loss, digital fraud and misuse of corporate information.
Explore service
Ransomware & intrusion analysis
Technical investigation of ransomware, malicious activity, network intrusions and possible data theft, from entry point to recovery validation.
Explore service
eDiscovery & dispute support
Electronic evidence preservation, targeted collection, document processing, technical analysis and support for legal review.
Explore service
Blockchain & digital asset tracing
Transaction tracing, wallet activity analysis and technical evidence reports for digital asset fraud and incident investigations.
Explore service
Forensic readiness
Evidence-source mapping, logging and retention review, preservation procedures and scenario exercises for investigation readiness.
Explore serviceA disciplined investigation.
A practical result.
Every engagement starts with an authorised scope and a question that can be tested. We identify relevant sources, document collection and handling, correlate findings and explain the limits of the evidence.
The result connects technical detail to the decision at hand: containing an incident, understanding information exposure, supporting a dispute or improving future readiness. An executive explanation and referenced technical findings let different audiences work from the same supported account.
What a digital investigation should establishThe wider investigation picture
OSINT, impersonation & digital exposure
Corroborated public-source research can support corporate enquiries, executive protection and investigation of deceptive online content.
Related expertiseConnected devices, IoT & operational environments
Specialist sources need a system-specific feasibility review, authorised access and coordination with the engineers responsible for safe operation.
Related expertiseWhat kinds of investigations do you cover?
Our technical scope includes devices and mobile data, email and cloud, network intrusions, malware, insider activity, digital fraud, electronic evidence and blockchain transactions. Public-source research and specialist connected-system questions can form related workstreams.
How do you keep an investigation proportionate?
We define the question, authorised sources, relevant period and reporting recipients before collection. New evidence may justify expanding the scope, which is documented with the case owner.
What should we share in the first enquiry?
Describe the issue, affected systems and urgency briefly. Call for an active incident and agree a secure channel with the team before sending sensitive evidence.
Can you work with our lawyers, insurer or existing IT provider?
Yes. We agree technical responsibilities, evidence requests, reporting and hand-offs with the authorised participants. Their legal, insurance and operational decisions remain within their roles.
Commission a digital investigation with a clear question.
Start with what you need to establish: a sequence of events, the origin of a disputed record or the activity associated with an account. A focused question helps define the relevant evidence and the limits of any conclusion.
Define the decision
Explain who needs the findings and what decision they must support. Technical reconstruction, an internal review and support for legal advisers may require different reporting arrangements.
Identify the evidence
Describe the relevant accounts, devices and time period without uploading evidence to the enquiry form. Access authority, preservation priorities and a secure transfer channel are agreed before collection.
Agree what can be concluded
Request a report that separates observations, interpretation and uncertainty. Missing logs, retention gaps and shared accounts can limit attribution; a plausible explanation is not proof of a person’s actions.
Do I need a forensic examination or a broader investigation?
A forensic examination analyses defined digital material. A broader investigation connects technical findings to a particular question and may require several evidence sources. We help determine the appropriate scope before acquisition or analysis begins.
Initial enquiries: reply within five days. Typical project duration: about one month, with the schedule agreed after scoping.
See the process and cost factorsA clear next step
Start with your question.
You do not need a technical specification to contact us. Describe the need and we will help define the right scope.
- Send a brief description and any deadline.
- We clarify scope, access and confidentiality.
- Receive a proposal with deliverables, timing and fees before work begins.
For an active security incident, call the team. Agree a secure channel before sharing evidence or sensitive information.