Digital forensics for serious matters.

Begin with a confidential case review. Tell us the device or data source, your authority over it, the key dates, what happened and what you need to prove or disprove. We then confirm scope, authority and next steps in writing.

Do not continue using, switching on, logging into, resetting or examining the device or account, and do not delete or move data. Continued activity can overwrite or destroy evidence. Preserve the item and speak to us first.

As soon as possible. Evidence is overwritten through continued use, automatic syncing, log rotation and remote wiping. Early preservation protects recoverability and should ideally precede any internal examination.

Urgent preservation can usually be arranged quickly once a signed engagement is in place and authority is confirmed. We respond to non-urgent enquiries within one business day. Analysis and reporting timescales depend on the number of sources and the questions to be answered, and we agree them in writing at the outset.

Yes. The initial discussion is confidential and carries no fee. Tell us only what we need to assess the matter, and please do not send evidence, passwords or case documents until we have agreed a secure transfer method.

Digital forensics is the structured identification, preservation, analysis and reporting of electronic evidence so it can be relied upon in legal, regulatory or internal proceedings. It applies repeatable, documented methods to devices, accounts and data while maintaining chain of custody.

Often, yes. Deleted files, fragments and traces of activity can frequently be recovered from unallocated space, journals and metadata, depending on the device, how it has been used and how quickly it was preserved. Continued use reduces what can be recovered.

Yes. We forensically examine iPhone and Android devices for messages, call logs, app data, location artefacts, media and deleted content, subject to lawful authority and the technical condition of the device.

Often, yes. WhatsApp and similar chat data, including some deleted content, may be recoverable from a device or backup where there is lawful authority and the data has not been overwritten or securely erased.

It depends on the device. A passcode, password or account credentials significantly improve access and the range of recoverable data. We advise on the options based on the specific device and your lawful authority over it.

Yes. With proper authority we review Microsoft 365 audit logs, mailbox activity, SharePoint and OneDrive access, sign-in records and sharing events to establish who accessed or moved what, and when.

Yes. We examine company devices and accounts for evidence of data exfiltration: USB transfers, cloud uploads, mass downloads, file copying and email forwarding, and report findings for HR, legal or court use.

Sometimes, where there is appropriate authority, consent or another lawful basis. Personal devices raise additional consent and privacy considerations under the Personal Data (Privacy) Ordinance, so we confirm the legal position and scope before any examination.

Often, yes, for cloud sources. Microsoft 365, Google Workspace and similar accounts can usually be preserved remotely with the account holder’s or organisation’s authority. Phones and computers are normally imaged in person or collected under a documented hand-over, so the chain of custody stays intact.

Sometimes. We examine metadata, file-system timestamps, embedded data and the device or account the file came from for signs of editing or back-dating. Where the evidence is inconclusive, our report says so rather than overstating a finding.

A digital forensic expert preserves data forensically, analyses it to establish what happened, and produces a clear report and exhibits. Where instructed, the expert provides independent opinion evidence and supports disclosure, litigation or internal investigations.

Yes. We prepare clear, defensible reports for legal proceedings, including exhibits and, where instructed, independent expert opinion compliant with the Rules of the High Court (Order 38) and the Code of Conduct for Expert Witnesses, including the expert's overriding duty to the court.

Forensic imaging is the creation of a verified, bit-for-bit copy of a device or data source, so the original is preserved and analysis is performed on the copy. The image is hash-verified to demonstrate its integrity.

Chain of custody is the documented record of who handled an item of evidence, when, and what was done to it, from acquisition to reporting. It demonstrates the evidence has not been altered and helps a court rely on it.

Yes. We support solicitors with forensic preservation, eDiscovery processing, targeted review, discovery of electronic documents and expert evidence, working to the instructions and procedural requirements of the matter.

Yes. We take no contingency or success fees, and our fee does not depend on the outcome. Where we act as an expert, our overriding duty is to the court, not to the party paying us.

Yes. We can review an opposing forensic report for method, scope, assumptions and whether its conclusions follow from the data, and advise instructing solicitors on points to put in questions or a responsive report.

Cost depends on the number and type of data sources, the volume of data, the urgency and whether expert reporting or court attendance is required. We provide a scoped estimate after an initial confidential discussion.

We are based in Hong Kong and work in person in Hong Kong, Singapore, Macau, Japan, South Korea, Thailand, Malaysia, the Philippines and Australia. For matters outside the Asia-Pacific region, we accept instructions only for work we can carry out remotely and lawfully from Hong Kong, and we do not attend on site outside those nine jurisdictions. Before accepting any instruction from outside them, we confirm in writing which services we can and cannot provide. This typically means second-opinion reviews of forensic findings, reviews of expert or police forensic reports, and smaller projects where the evidence can be transferred to us securely.

Unless you instruct us otherwise, we keep forensic images and case files securely for up to one year after a matter that does not go to court. Where a matter goes to court, we keep them for three to six months after it concludes, to cover any appeal. Data is then returned or securely destroyed, and destruction is recorded.

Yes, when we are instructed through solicitors for the purpose of litigation or legal advice. Where privilege matters, we recommend that instructions come through your lawyers, and we mark our work product accordingly.