WhatsApp
← Blog·Guides·09/02/2026
Choosing a digital forensics company — checklist with magnifier, accreditation rosette and laboratory beaker.

How to choose a digital forensics company.

The UK forensics market is uneven. Some laboratories are outstanding, court-tested and quietly professional; others produce reports that read well on the page and fall apart at the first serious cross-examination. The distinction is rarely visible from the website. This guide sets out the questions that separate the two, the accreditations that actually mean something, and the shape of the answer a good provider will give when you ask.

Instructing a forensic provider is a professional-conduct decision as much as a procurement decision. The examiner's name is going on a report you may rely on in front of a tribunal, and their methodology is going to be scrutinised by whichever side did not commission it. The questions below are the ones instructing solicitors we work with have learned to ask; the accompanying answers describe what a defensible response looks like.

The questions that actually separate providers

QuestionWhat a defensible answer looks like
Which of your examiners will do the work?A named individual, their qualifications, their court experience, and their availability for cross-examination on the trial dates.
What accreditation does the laboratory hold, and to what scope?ISO/IEC 17025 with a defined scope covering the extraction and analysis types in scope — plus a willingness to share the scope schedule.
How is chain of custody documented in practice?Sealed evidence bags, contemporaneous handling log, hash values at every stage, and working copies never analysed on the original.
Do you follow the ACPO Good Practice Guide?Yes, with a written methodology cross-referenced to the four ACPO principles, available on request.
Can I speak to a solicitor who has instructed you on a comparable matter?One or two named referees you can call directly, subject to their client's consent.
What is your position when the evidence does not support the instructing party's case?The report says so. The examiner's duty is to the court; that is stated on the face of the report and in the engagement letter.

Accreditations, in plain terms

  • ISO/IEC 17025 — the international standard for testing and calibration laboratories, adopted by UK forensic providers under UKAS. What matters is the scope, not merely the certificate.
  • FSR Codes of Practice — the Forensic Science Regulator's expectations for forensic units used by UK criminal justice; increasingly cited in civil work too.
  • Cyber Essentials Plus — a floor for the provider's own information security, not a substitute for forensic accreditation.
  • Individual certifications (EnCE, CCE, CCPA, GCFE, etc.) — useful indicators of examiner competence; not a substitute for laboratory accreditation.

Warning signs at intake

  • Guaranteed unlock or guaranteed recovery, without seeing the device.
  • Reluctance to name the individual examiner, or to confirm their court experience.
  • No written methodology, or a methodology that reads as marketing copy.
  • Unwillingness to state, in the engagement letter, that the report will follow the evidence.
  • Fee estimates given without a written scope of work.

The single most useful question to ask a prospective provider is: 'What have you told a client, in writing, that they did not want to hear?' A good examiner has an answer. A weak one does not.

What a good engagement looks like

  1. 01
    Scoping call. Thirty minutes with the named examiner, not a sales lead, focused on the questions the tribunal needs answered.
  2. 02
    Written engagement letter. Issues, sources, standard, deadline, fee estimate with a ceiling, and the examiner's declaration of duties.
  3. 03
    Preservation, before analysis. Sealed, hashed acquisition of every source in scope, documented as it happens.
  4. 04
    Interim update. A short written note after triage, so the analysis budget is not committed blind.
  5. 05
    Report and, if needed, testimony. A Part 35-compliant report signed by the examiner named at engagement — no substitutions.

Frequently asked questions

Does ISO/IEC 17025 accreditation matter for civil work?

Yes. It signals that the laboratory's methodology has been assessed by an independent body against an international standard. In criminal work it is increasingly expected; in civil work it is a meaningful differentiator when the report is challenged.

What if the provider we usually instruct is not accredited?

Ask what independent quality assurance they operate against, and what their peer-review process is. A small unaccredited laboratory with a rigorous internal QA process can still produce defensible work; a large unaccredited provider without one is a harder sell to the court.

Should we always get more than one quote?

For a first instruction, yes — but compare on scope and methodology, not headline price. The cheapest quote is often the one that has not read the pleadings.

Can we instruct on a fixed fee?

Preservation and scoping, yes. Analysis is estimated with a written ceiling and any variation approved before it is incurred. Fixed-fee analysis on an open scope is a warning sign, not a benefit.

What if the report goes against our client?

That is what an independent expert is for. A good provider will have flagged the risk at scoping and at interim update, so nothing in the final report is a surprise on the day of service.