⚠ Do now
Owner-authorised computer forensics for Windows PCs, Macs, laptops and internal storage, including preservation, targeted examination and recoverable-data assessment.
Computer forensic work is question-led. We agree what must be preserved or located, which devices are in scope and how results should be documented before technical work begins.
Stop ordinary use and avoid installing recovery or forensic tools. Do not reset the operating system, run cleanup utilities or open files to check them. Record the computer’s condition, date and time, connected devices, known accounts and any actions already performed.
If a hard drive is clicking, a laptop is liquid damaged or the computer will not power on, disconnect power when safe and tell us before shipping. The storage may need physical recovery before any forensic examination can proceed.
Computer forensics is used when the context, handling and evidential questions matter. Data recovery is used when the primary objective is restoring inaccessible files. Some cases require both. Learn about digital forensics, hard drive recovery and SSD recovery. If you suspect monitoring or remote-access software in a domestic or family violence matter, see domestic violence digital forensics.
Do not interact with it unnecessarily. The safest action depends on whether it is already on, encrypted, remotely accessible or physically damaged. Call for case-specific preservation guidance.
Yes, matters can be assessed for Windows and macOS systems. Available acquisition and examination options depend on the model, storage, encryption and credentials.
Sometimes. SSD wear-levelling and TRIM, later computer use, encryption, overwriting and physical damage can limit recovery. Early preservation improves the assessment.
Known credentials can be important for encrypted computers. Provide them only through the secure method agreed during intake, together with any relevant account information.
Yes, when they act for an authorised party and the authority, scope, communication path and intended deliverables are clear before work begins.
Tell us who owns or authorises the computer, what happened, which questions need answers and whether a legal or operational deadline applies.