Computer Forensics
Windows & Mac
Whether you need to recover deleted evidence, understand what happened on a device, or build a defensible record for legal proceedings — we examine Windows and macOS systems methodically and report exactly what the data shows.
Computer forensics involves the systematic acquisition and analysis of data from Windows and macOS systems — recovering what was deleted, reconstructing what happened, and documenting it in a way that holds up to scrutiny.
Forensic Disk Imaging
Creating a verified, write-protected forensic copy of the drive before any analysis begins — preserving the original state of all data.
Deleted File Recovery
Recovering deleted files from the file system, unallocated space, and recycle bin — including files deleted before our involvement.
User Activity Analysis
Reconstructing what a user did on the machine — files accessed, applications run, USB devices connected, and system events logged.
Browser & Internet Artefacts
Examining browser history, cached content, downloads, search queries, and web-based account activity across major browsers.
Email & Communication Recovery
Recovering and analysing locally stored emails, messaging application data, and communication logs from the examined system.
Forensic Evidence Report
A structured report documenting findings, methodology, and chain of custody — suitable for legal proceedings, HR investigations, or insurance claims.
Computer forensics is used in legal disputes, workplace investigations, fraud cases, and situations where you need to know exactly what happened on a device.
You suspect an employee copied confidential files or data before leaving the company
You need to recover files deleted from a computer involved in a dispute or incident
A device may contain evidence relevant to a legal case or police report
You need to verify whether a computer was accessed or tampered with without authorisation
You are an attorney or HR professional who needs a forensically sound examination and report
You suspect malware or an intrusion and need to understand what happened and what was affected
How We Work
Intake
You describe the situation and what you need to establish. We define the scope of examination together.
Acquisition
We create a forensic image of the device or storage media — preserving the original and working only from the copy.
Examination
We analyse the image for relevant artefacts — files, logs, activity timelines, and anything recoverable from deleted space.
Analysis
We contextualise the findings against your specific case — building a factual, timeline-based account of what the data shows.
Report
You receive a structured forensic report with documented methodology, findings, and guidance on next steps.
Common Questions
Do you work on both Windows and macOS systems?
Yes. We examine both Windows (XP through Windows 11) and macOS systems. The artefacts and analysis methods differ between platforms, and we apply the appropriate techniques for each.
Can you recover files that were deleted a long time ago?
It depends on the file system and how much activity has occurred on the drive since deletion. Deleted data remains recoverable until the storage space is overwritten. We assess recoverability during the examination and report what we find — we do not make guarantees before examining the device.
Will the examination affect or alter the original device?
No. We work from a verified forensic image — a bit-for-bit copy of the original drive — so the original device is never modified during analysis. Hash verification confirms the integrity of the copy before any work begins.
Is the report suitable for use in court or legal proceedings?
Our reports are structured with documented methodology, chain of custody records, and verifiable findings — designed to meet the standards required for legal proceedings. Whether a report is formally accepted depends on the jurisdiction and case, which is a matter for your legal counsel to determine.
Do I need to send the device to you?
For a full forensic examination, we typically need physical access to the device or a forensic image you can provide. We can advise on secure shipping or imaging procedures depending on your situation and location.
Need to know what's on a device?
The sooner a forensic image is taken, the more data can be preserved. Do not use or alter the device — contact us now for a confidential consultation.
Get Help Now