PROBLEM
There is a disk, image, phone or log set, and nobody recorded where the material came from or what must not be touched on the original.
PODEJŚCIE
Controlled intake, working copy, timestamped activity log, and conclusions labelled as fact or hypothesis.
SCOPE
- material intake and provenance
- working copy and original protection
- artefact analysis (disk, logs, selected apps)
- observation notes and limits
DELIVERABLE
- activity log (who, when, what)
- artefact and path list
- conclusions with explicit limits
PROCESS
- intake and legal constraints
- copy / hashing agreed with the owner
- lab analysis
- report
Forensics fails on procedure, not on the tool name. Without a record of “when, from where, who handed it over”, later work is decoration — even if a scanner “finds something”.
I take in material (disk image, logs, account export, agreed capture), make a working copy where we agree, and keep an activity log. Conclusions stay separate from guesses: what the artefact shows, what cannot be stated, what needs another source.
This service fits when you need structured analysis before a business decision, escalation or further work with counsel — not when you want a crime serial.
Out of scope unless agreed otherwise: court expert testimony, working on the only copy of evidence, a promise to recover everything.