Cyber investigations

We work closely with you to clearly define the investigation's scope. This includes: 

• defining objectives;  
• developing a plan; and   
• working with your counsel to ensure compliance with relevant laws and regulations.  

Our phased approach allows earlier results to guide future phases. We verify potential legal expert involvement during scoping. Once the scope is clear, we resource the team and set a budget based on defined objectives, which is agreed upon and not exceeded without your approval. 

We take a sophisticated approach to information gathering, focusing on collecting the most valuable data and using our advanced eDiscovery expertise, techniques and tools to refine this data. Our in-house data science capability helps us analyse both structured and unstructured data. 

We can also conduct detailed surveillance of a user's interactions with the digital world. This ranges from an ability to forensically understand a user's behaviour, to the deployment of tooling which, given the proper authority and precautions, enables very close surveillance of the person's behaviour. However, some information can only be gathered through interaction with the real world. Should this be necessary, we involve specialists with expertise in interview and investigatory techniques for real-world information gathering to gather this information for us. 

We analyse the gathered data to identify patterns, inconsistencies, and key facts to form hypotheses we test to build a confident understanding of events. Where forensic data is analysed as part of the investigation, we are often able to factually set out the events that took place, and cross-check information from different sources to confirm its accuracy and reliability wherever possible. If there are gaps, or if the information’s reliability is uncertain, we will clearly state any limitations or assumptions. 

Once our analysis is complete, we often work with counsel to understand the impact of our findings and to scope any necessary reports. As part of this work, we frequently produce expert reports, designed to be presented as evidence in court. If necessary, we support the delivery of an expert report through attendance at court to deliver testimony and undergo examination.   

Where the other party in legal proceedings has also employed an expert, we often work with these experts to highlight areas of mutual agreement and disagreement to the court.  

The structure of our reports is tailored to anticipate the actions that will be needed because of our investigation. If counsel is involved, we take their instruction on the report's structure into account. If we are acting as experts, we normally expect to answer the questions put to us by counsel or the court independently, based on the facts obtained as part of our investigation.  

Our report is always reviewed in draft by all stakeholders before it is finalised. We take an independent view of revisions, ensuring that our report fairly represents the facts of the investigation and clearly explains any limitations or assumptions made. Our reports are confidential to our clients, unless we agree otherwise (for example, to their submission to court by our client's counsel). 

Depending on the outcome of the investigation, it may be necessary to implement enhanced monitoring to ensure that risks are mitigated as part of implementing the findings of the engagement. We can provide the tools needed to implement enhanced monitoring of a digital environment, whether this is caused as a result of a cyber threat or internal misuse. 

Other than our report and any notes that we may have taken, we destroy forensic evidence 30 days after the end of the engagement, unless we are instructed to store the materials or return the materials to our client.  

If we are instructed to store the materials, we charge a modest storage fee to ensure that we maintain the authorisation to hold the data, which is essential to meeting the requirements of privacy laws across the world, including GDPR.