Blog · Knowledge centre
Notes from the practitioners.
Written for solicitors, in house counsel, government teams and private clients who need to understand what digital forensics can do for a case, before commissioning the work.
§ 01 · Featured
Start here.
Method
Don't Ask What Is on the Phone: Framing Forensic Questions
Asking an expert what is on a phone leads to bloated costs and privacy risks. Learn how targeted digital forensic questioning produces clear, admissible evidence.
Read →
Method
Did an Employee Copy Files to a USB Stick? Digital Traces Explained
Learn how forensic analysis detects unauthorised file copying to USB devices by evaluating Windows registry keys, event logs, shellbags, and volume serial numbers.
Read →
Method
Is This Email Genuine? Seven Digital Clues That Help Authenticate It
A detailed guide to authenticating email evidence in UK legal proceedings, covering technical header analysis, cryptographic signatures, and chain of custody.
Read →
§ 02 · Archive
The full archive, by subject.
Mobile forensics
- → Mobile phone forensics: the core principles and how it works.
- → Physical extraction: what it reaches, and what it does not.
- → What a mobile phone forensics expert actually does for your case.
- → Cell site analysis: what it can and cannot say about where a phone was.
- → Social media forensics: turning posts, DMs and metadata into evidence.
- → Suspected mobile hacking: how a forensic investigation is actually run.
- → The role of mobile phone experts in civil and criminal litigation.
WhatsApp forensics
Cyber
- → You think you have been hacked. What to do in the next twenty four hours.
- → Engaging a computer hacking investigator: what to expect.
- → Why cyber forensics has become critical for UK legal and corporate work.
- → Penetration testing: what it is, what it is not, and when to commission it.
- → Incident response: what it means in practice.
Method
- → Don't Ask What Is on the Phone: Framing Forensic Questions
- → Did an Employee Copy Files to a USB Stick? Digital Traces Explained
- → Is This Email Genuine? Seven Digital Clues That Help Authenticate It
- → Who Downloaded That Confidential File? Using M365 Logs to Find Out
- → Screenshots vs Real Conversations: Proving Chat Evidence in UK Courts
- → The digital forensics chain of custody, in plain terms.
Guides
- → Logical vs physical extraction: choosing the right method.
- → What device acquisition means, and why it matters.
- → Forensic triage: getting the right answer, faster.
- → Preserving email evidence: a practical guide for solicitors.
- → Data preservation in 2026: what has changed, and what has not.
- → Cybersecurity for solicitors: the 2026 UK guide.
- → Investigating insider threats without breaking the evidence.
- → The investigation workflow, explained for legal professionals.
- → Password cracking in forensics: techniques and workflow.
- → How to choose a digital forensics company.
- → Computer forensics vs digital forensics: what's the difference?
Forensics & law
- → Instructing a computer expert witness: what solicitors need to know.
- → Legal applications of digital forensics across UK practice.
- → How digital forensics helps solicitors defend their clients.
- → Digital forensic artefacts and their evidential value.
- → Digital document forensics: is that document genuine?
- → The UK digital evidence backlog: what it means for defence teams.
- → Family Court phone evidence that stands up.