Windows laptops, desktops and servers. What was opened, copied, deleted or plugged in, and when.
Including Apple Silicon and FileVault-encrypted machines. File history, activity logs and backups.
iPhone and Android. Messages (including deleted), calls, WhatsApp and Signal chats, photos and location.
Microsoft 365, Google Workspace, iCloud, Teams and Slack. Email compromise, spoofing and files sent outside the business.
One timeline across every device, chain of custody throughout, and a plain-English report ready for court.
Describe the matter and we will tell you which devices and accounts are worth examining — and which are not.
Scope It with Us →Employee data theft and IP exfiltration, suspected fraud and misconduct, concealed assets and communications in family or insolvency proceedings, workplace investigations, and disputes over what a document or message really shows. If a departing employee may have taken data, early forensic preservation of their laptop, phone and cloud accounts is often decisive.
Devices are imaged through write-blockers, on site or at our Brisbane lab, and every copy is hash-verified so the original is never altered. Cloud and email data is acquired in whatever way the matter allows: administrator credentials supplied by the client, the platform's own native export tools, production under court order or subpoena, or recovery of cached and synced copies from the device itself. Where email authenticity is the question, our free Email Header Analyser is a useful first check before formal examination.
Artefacts on their own rarely settle anything. The value is in what they establish together: a single timeline drawn across laptop, phone and cloud account showing who did what, on which device, and when. Findings are set out in plain English, with the technical basis for each conclusion recorded so another examiner could follow the same steps and reach the same result — and so the report holds up when it is tested.
Most examinations complete within 7–14 days. Urgent preservation — imaging a device before it leaves the building — can usually be arranged within 24–48 hours anywhere in Australia.
Not always. Cloud accounts, email and many backups can be acquired remotely. Where a device is required, it can be shipped to our Brisbane lab under documented chain of custody or imaged on site.
No. Devices are imaged through write-blockers and all analysis is performed on verified forensic copies. The original is never altered — that is the difference between forensics and "having IT take a look".