Digital
forensics Brisbane

An examiner preserves the device, makes a verified copy, examines only the questions agreed in writing, and reports what the data shows with the method and the limits stated. Most of the work is careful recording: every finding has to be traceable to where it sits on the device, so a second examiner can check it.

No. Cybersecurity prevents and responds to attacks while they are happening. Digital forensics looks back at what a device holds and what happened on it. If a network is under active attack or ransomware is still spreading, contain it with an incident response provider first. Forensic preservation comes next.

A forensic disk image copies the readable sectors acquired from storage; a mobile extraction may instead capture a supported subset of files or records. Hashes verify the acquired material and its copies, not completeness. The report records unreadable areas, acquisition limits and any changes to the source. You can see how the hash check works in the hash demo on this page.

Computer forensics is digital forensics applied to Windows PCs, Macs, laptops and their drives. It covers file activity, USB connection history, user accounts, browser history and deleted documents. Our computer forensics page explains the questions it can answer.

Mobile phone forensics is the extraction and examination of data from iPhones, Android phones and tablets: messages, photos, call logs, locations and app data. How much can be extracted depends on the model, the software version and whether the passcode is known. See mobile phone forensics.

Forensic data recovery combines documented repair-to-read or reconstruction work with evidence preservation when a device is damaged or data is inaccessible. It cannot restore overwritten content or encryption keys destroyed by a completed secure erase. See forensic data recovery.

Look for a named examiner with a recognised certification, a written scope, hash-verified copies, reports that separate located from recovered data, fixed fees per stage, and someone willing to tell you what cannot be done. Our six checks set out the questions to ask any digital forensics expert, including us.

We establish the instructing party’s lawful authority and agree the devices, accounts and questions in writing. Possession or ownership of a device does not automatically authorise access to every account or another person’s information. Where authority is disputed or unclear, obtain appropriate legal advice before examination.

Courts decide what evidence is admitted, under the Evidence Act 1995 (Cth), the Evidence Act 1977 (Qld) and the equivalent laws of each state. What we control is the work: a chain of custody record, hash-verified images, an examiner-signed report that sets out method and limitations, and an examiner CV on request. Tell us the intended use at the start, so the scope and the report suit it. We do not promise outcomes.

Yes. Our laboratory is in Brisbane and we take matters from across Australia. Devices travel sealed by tracked Australia Post Express, or we collect in the Brisbane area. Instructions, scope meetings and report walk-throughs can be done by phone or video.

It depends on the number of devices, their condition and the number of questions. We give an expected timeframe with each stage quote, and we tell you straight away if a deadline is at risk, so you can decide what to prioritise.

Each stage is a fixed fee quoted in writing before it starts: forensic access and imaging per device first, then examination and report for each question you choose to go ahead with. The fee depends on the device, its condition and the scope. How our forensic fees work explains the stages.

Sometimes. It depends on the model, the software version, the security patch level and the lawful options available. We do not promise access before assessment. If you know the passcode, give it to us through the secure method we agree at intake, never in an ordinary email or text.

No. Results depend on the storage technology, encryption, how much the device was used afterwards and its physical condition. Deleted data that has been overwritten, or that sat on a phone that was later factory reset, cannot be recovered by anyone. Nobody can know what survived until the device is imaged and examined.

Not from the phone itself. A reset on a modern iPhone or encrypted Android phone destroys the keys, so the old data cannot be read. Copies may still exist in a backup, on another device or in an account. Our guide to deleted messages after a factory reset explains where to look.

Only for as long as agreed in writing at intake. Forensic images and working copies stay in our custody in Brisbane, and are destroyed when you instruct us, with a certificate of destruction on request. We handle personal information under the Australian Privacy Principles.