Home/Services/Digital Forensics/Computer Forensics
// COMPUTER FORENSICS

Computer Forensics

What happened on a computer, and who did it. We image Windows and Mac computers, laptops and external drives without altering them, then reconstruct user activity: files opened, copied and deleted, devices connected, and sites visited.

IN SHORT

Computer forensics is the examination of Windows and Mac computers, laptops and external drives to establish what a user did: files opened, copied and deleted, devices connected and sites visited. We image the device without altering it and report the findings in a form a court can rely on.

What We Examine

File SystemsWindows NTFS, macOS APFS and external drive formats, including file creation, modification and access times.
USB and External DevicesRecords of which storage devices were connected, when, and which files were accessed from them.
Documents and MetadataAuthor, revision and edit history inside Office, PDF and image files.
Browser HistoryVisited sites, searches, downloads and saved logins across Chrome, Edge, Safari and Firefox.
System and Event LogsLogons, shutdowns, program execution and remote access sessions.
Local Mail and Cloud SyncOutlook data files and locally synced OneDrive, Dropbox and Google Drive folders.

When It Matters

  • →Departing employees suspected of taking confidential files or client lists
  • →Fraud and financial misconduct investigations
  • →Testing computer evidence in a police brief for a defence team
  • →Disputes about when a document was created or changed
  • →Family law matters involving hidden assets or records
  • →Workplace misconduct and policy breaches

Activity Is Not the Same as Attribution

A computer records what happened, not always who was at the keyboard. We report user activity against account logons, other devices and the wider evidence, and state plainly where the data cannot say who was responsible.

Reviewing an analysis prepared by police or another expert? See disclosure and case review.

Related Guides

Common Questions

Do you need the computer itself?+

Usually yes, or a forensic image of it. We can collect on site, or you can courier the device to us under documented chain of custody.

Will the examination change anything on the computer?+

No. We work from a verified forensic copy made with write-blocking hardware, so the original stays as it was.

Can you examine a work computer that was reissued or reset?+

Often some material survives. Tell us what has happened to the machine and we will advise what is likely to be recoverable before any work begins.

Before You Call

01Stop Using the DeviceNew messages, app updates and photos can overwrite deleted data. Leave it as it is, keep it charged, and don't let anyone "have a look" first.
02Don't Delete, Reset, Wipe or UpdateA factory reset or removing apps can make recovery impossible, and deleting material can count against you in court. Don’t install operating system or app updates either: an update can overwrite deleted data and change what can be extracted.
03Isolate It If It Could Be WipedIf someone else could remotely lock or erase the device, switch on flight mode. Ask us before powering it off.
04Write Down What You KnowKey dates, what you need to establish, and any passcodes. It lets us scope the work accurately on the first call.

Have a Matter You'd Like to Discuss?

A certified examiner responds within one business day — in confidence, no obligation.

Request a Confidential Consult