What is it?

Digital forensics (or forensic computing) means extracting, preserving and analysing the data held on digital media — computers, phones, servers, online accounts, removable media — in order to establish facts and produce usable evidence.

It differs from OSINT in its object: OSINT exploits public information, while forensics analyses media to which the expert has legitimate access (equipment handed over by its owner, seizure ordered by a judge, the client company's own systems).

The key point: chain of custody. Digital evidence is only worth something if you can show it has not been altered: bit-for-bit copy, cryptographic hashes, a log of every handling step. That is what separates an expert examination from simple “data recovery”.

Use cases

Dispute with a former employee

Client files or trade secrets copied before leaving: reconstruction of transfers, connected USB drives, emails sent to a personal account.

Cyberattack and ransomware

Understanding how the attacker got in, what they viewed or exfiltrated, and documenting the incident for the insurer and the authorities.

Family or criminal proceedings

Analysis of a phone handed over by its owner: messages, photos, geolocation, with a report the lawyer can use.

Internal fraud

Recovering deleted emails, changes to accounting documents or abnormal access to an information system.

Authenticity of a document or image

Metadata, editing traces, date consistency: establishing whether a file has been altered.

Counter-examination

Reviewing the opposing party's expert report and checking the method, the chain of custody and the conclusions.

How an assignment unfolds

Practices vary from one professional to another, but a serious assignment generally follows these steps:

1

Legal scoping

Who owns the media? What is the legal basis for access (consent, court order, employment contract)? Without a legal basis, the evidence will be thrown out.

2

Acquisition and preservation

Forensic copy of the media with a write blocker, hash calculation, sealing and traceability of every handling step.

3

Analysis

Examination of the copy with specialized tools: deleted files, histories, system logs, metadata, timeline of events.

4

Expert report

Factual findings, a method described so it can be reproduced, technical appendices. The report must be understandable by a non-technical judge.

5

Testimony

If needed, the expert presents and defends their conclusions in court.

Qualifications and framework

What we require: a registered business and professional liability insurance. There is no single licence for forensics; recognized qualifications are technical certifications (for example GCFA, EnCE, CHFI) and, in France, registration on a court of appeal's list of judicial experts. When a professional displays this kind of qualification on their profile, ask for proof.

Our checks are described in detail on the page How we verify.

Limits to be aware of

Legitimate access is essential: analysing a third party's phone or computer without their consent or a court decision is illegal, and the evidence obtained is generally inadmissible.
Encryption: a recent, locked and encrypted device may remain inaccessible, whatever the tools.
Overwritten data: a deleted file can only be recovered as long as its location has not been reused. The longer you wait, the less you find.
Cost and time: a rigorous, documented and reproducible examination takes time; be wary of promises of results within 24 hours.

Good reflex: after an incident, do not switch the device on or off and do not “dig around” in it yourself. Every action can erase traces or weaken the evidence. Contact an expert first.

Rates

Each professional sets their rates according to the scope, urgency, country and technical complexity of the assignment. Seek & Find does not set these prices: always ask for a written quote detailing the method, the deliverable and the timeline.

Need a digital forensics expert?

Seek & Find lists vetted professionals: browse their profiles and contact them directly.

Find an Expert