Specialist examination of physical evidence, digital devices, electronic evidence and cyber incidents.
Forensic work answers a narrower question than an investigation does, and answers it more definitively: what does this evidence actually show?
We cover both sides of that work, physical evidence examination and digital and cyber forensics, and the two are frequently needed on the same matter. Evidence is handled so that its integrity and continuity are preserved from the point we receive it, because evidence that cannot be shown to be intact is not much use to anyone.
Engagements come from individuals, from companies, and from lawyers preparing a matter for court.
Systematic examination and documentation of a scene: recording it as found, identifying and recovering physical evidence, and preserving it correctly so that later examination and any subsequent proceedings are not compromised.
Recovery, development and comparison of fingerprint evidence from surfaces and articles, with findings documented for use as evidence.
Examination of documents whose authenticity is disputed: signatures, handwriting, alterations, insertions, and whether a document is what it claims to be. Commonly needed in property and inheritance disputes, contested agreements, cheque and instrument matters, and wills.
Forensic examination of phones and tablets: messages, call activity, application data, media and location artefacts, carried out on a preserved copy so that the original device is not altered.
Examination of laptops, desktops, servers and storage media to establish what was done on a system, by whom and when: file activity, external device connections, installed software, and traces of removal or concealment.
Forensically sound capture of digital evidence, with integrity verified at the point of acquisition and continuity documented from then on.
This matters more than it sounds. Evidence collected informally, a screenshot, a phone handled after the fact, a file copied across, is frequently the reason a strong matter becomes an unusable one. If a device may become evidence, the earlier we handle it the better.
Recovery and examination of deleted material: messages, files, media, logs and records, and, where it can be established, the fact and timing of deletion itself, which is often as significant as the content.
Investigation following an intrusion, account compromise, ransomware event, business email compromise or fraud carried out through a system. We establish how access was obtained, what was reached, what was taken or altered, and what remains exposed.
Examination of email and messaging evidence: authenticity, origin, whether headers or content have been manipulated, and reconstruction of a communication sequence across accounts and platforms.
Examination of server, application and access logs to reconstruct activity: who connected, from where, when, and what was done. Frequently the record that establishes a timeline when nothing else does.
Investigation of confidential or personal data leaving an organisation. We establish the route, the volume, the timing and the responsibility, and what the exposure now is.
Findings set out in a written report: what was examined, the method used, what was established and, importantly, what could not be established.
Reports are prepared to be read by people who are not forensic specialists, because the audience is usually a court, a board or a lawyer rather than another examiner.
Target C does not sell forensic equipment or products. The old site's forensic page read as a supplier catalogue aimed at laboratories and government buyers, which described a different business entirely. That framing is gone.
Contact us before it is handled further. Powering a device on, logging into an account or copying a file can change or destroy the very record that would have answered the question.
Tell us what you need to establish. A first conversation carries no obligation.