Skip to main content

Our capabilities

Thomas Murray’s investigatory capability is founded on our deep experience of helping our clients analyse events around criminal and civil matters around the world, spanning:

Investigating leaks of sensitive information

Investigating leaks of sensitive information at the board level of substantial, multinational organisations. 

Acting as experts to the High Courts of England and Wales

Acting as experts to the High Courts of England and Wales in the assessment of challenges to the immunity against prosecution of a Nation State. We were employed as experts by the Nation State’s counsel. 

Acting as experts to the High Courts of England and Wales

Investigating allegations of criminal fraud, which resulted providing expert testimony in the UK and a European nation’s criminal courts. Defendants in multiple different investigations received prison sentences for their crimes. 

Conducting analysis and providing expert testimony in a wide variety of disputes between parties,

Conducting analysis and providing expert testimony in a wide variety of disputes between parties, usually centered on allegations of fraud, insider trading or misuse of intellectual property. 

Running discreet investigations into alleged issues within high-net-worth families. 

Running discreet investigations into alleged issues within high-net-worth families. 

Running discreet investigations into alleged issues within high-net-worth families. 

Providing expert witness testimony around issues in disclosure and the processing of information, using our extensive experience in eDiscovery. 

Our approach

Our approach to corporate investigations follows a structured process to ensure thoroughness, legality, and effectiveness:  

1. Scope: preparation and planning

1. Scope: preparation and planning

We work closely with you to clearly define the investigation's scope. This includes: 

  • defining objectives;  
  • developing a plan; and   
  • working with your counsel to ensure compliance with relevant laws and regulations.  

Our phased approach allows earlier results to guide future phases. We verify potential legal expert involvement during scoping. Once the scope is clear, we resource the team and set a budget based on defined objectives, which is agreed upon and not exceeded without your approval. 

2. Information gathering and analysis

We take a sophisticated approach to information gathering, focusing on collecting the most valuable data and using our advanced eDiscovery expertise, techniques and tools to refine this data. Our in-house data science capability helps us analyse both structured and unstructured data. 

We can also conduct detailed surveillance of a user's interactions with the digital world. This ranges from an ability to forensically understand a user's behaviour, to the deployment of tooling which, given the proper authority and precautions, enables very close surveillance of the person's behaviour. However, some information can only be gathered through interaction with the real world. Should this be necessary, we involve specialists with expertise in interview and investigatory techniques for real-world information gathering to gather this information for us. 

2. Information gathering and analysis

3. Verification

3. Verification

We analyse the gathered data to identify patterns, inconsistencies, and key facts to form hypotheses we test to build a confident understanding of events. Where forensic data is analysed as part of the investigation, we are often able to factually set out the events that took place, and cross-check information from different sources to confirm its accuracy and reliability wherever possible. If there are gaps, or if the information’s reliability is uncertain, we will clearly state any limitations or assumptions. 

Once our analysis is complete, we often work with counsel to understand the impact of our findings and to scope any necessary reports. As part of this work, we frequently produce expert reports, designed to be presented as evidence in court. If necessary, we support the delivery of an expert report through attendance at court to deliver testimony and undergo examination.   

Where the other party in legal proceedings has also employed an expert, we often work with these experts to highlight areas of mutual agreement and disagreement to the court.  

Thomas Murray cyber alerts

Thomas Murray cyber alerts

Subscribe to stay up to date with developing threats in the cyber landscape

4. Reporting

The structure of our reports is tailored to anticipate the actions that will be needed because of our investigation. If counsel is involved, we take their instruction on the report's structure into account. If we are acting as experts, we normally expect to answer the questions put to us by counsel or the court independently, based on the facts obtained as part of our investigation.  

Our report is always reviewed in draft by all stakeholders before it is finalised. We take an independent view of revisions, ensuring that our report fairly represents the facts of the investigation and clearly explains any limitations or assumptions made. Our reports are confidential to our clients, unless we agree otherwise (for example, to their submission to court by our client's counsel). 

4. Reporting

5. Action and follow-up

5. Action and follow-up

Depending on the outcome of the investigation, it may be necessary to implement enhanced monitoring to ensure that risks are mitigated as part of implementing the findings of the engagement. We can provide the tools needed to implement enhanced monitoring of a digital environment, whether this is caused as a result of a cyber threat or internal misuse. 

6. Closure

Other than our report and any notes that we may have taken, we destroy forensic evidence 30 days after the end of the engagement, unless we are instructed to store the materials or return the materials to our client.  

If we are instructed to store the materials, we charge a modest storage fee to ensure that we maintain the authorisation to hold the data, which is essential to meeting the requirements of privacy laws across the world, including GDPR. 

6. Closure

Thomas Murray is a proud member of the North West Cyber Security Cluster

The North West Cyber Security Cluster (NWCSC) is a collaboration of cyber security professionals and experts in the North West region. The NWCSC aims to promote innovation, support skills growth, and develop a robust cyber security ecosystem.

NWCSC Members Badge