Digital Forensics Investigation
Examining computers, servers, and digital media to establish what happened and when.
Last reviewed
What does this service cover?
We examine computers, external drives, and network storage media using forensically sound methods to establish what happened and when. Our examiners use hardware write-blockers when acquiring bit-stream images, to preserve bit-level integrity.
When do you need it?
Investigating employee misconduct, unauthorised access, or intellectual property exfiltration.
Preserving and analysing electronic evidence for civil litigation or criminal defence.
Reconstructing file creation, modification, deletion, and USB connection timelines.
DIGITAL FORENSIC PROTOCOL
The Digital Forensic Examination Process
Chain of Custody & Intake
Intake logged on a chain-of-custody record, with a cryptographic hash recorded for each exhibit.
Hardware Write-Blocked Imaging
Hardware write-blocked imaging creating an exact, bit-level duplicate of the original media.
Artefact Extraction & Analysis
In-depth analysis of Windows registry hives, event logs, file creation timestamps, USB connections, and deleted files where the data is still recoverable.
Forensic Report
A chronological timeline of events with the technical findings that support it.
What do you receive?
A court-ready forensic report detailing the chronological sequence of events and technical findings. Whether evidence is admitted is decided by the court in each case. Expert witness testimony when instructed by counsel or the court.
- Hardware write-blocked bit-stream disk imaging
- Cryptographic hashing to show the copy matches the original
- Reconstruction of user activity and file timelines
- Reports prepared for use in legal proceedings
FAQ
What do people ask about it?
How is digital evidence preserved?
We work from preserved copies created using hardware write-blocked imaging, record cryptographic hashes of digital exhibits, and maintain a chain-of-custody record.
Are your digital forensic reports accepted in court?
Our reports are prepared for use in legal proceedings and have been relied on by Kenyan courts. Whether evidence is admitted is decided by the court in each case.
Read the guides
NEXT
Call or WhatsApp us; we confirm scope and give an estimate before work begins.
Related Forensics Services
Start with a
confidential conversation.
View Park Towers, 20th Floor, Nairobi
+254 701 543 158
Monday–Friday 08:30–17:00 · Saturday 10:00–14:00
Remote consultations available on request.
Please don't send case details or evidence until we've agreed a secure way to receive them.