// Establish the facts without compromising the evidence.
Digital forensics
Doubts about how a workstation has been used, an employee leaving with unanswered questions, a suspected data leak: the answers are almost always written on the disk. The difficulty is reading them without destroying what you are looking for. I analyse your workstations and storage media using a traceable method, and deliver factual, timestamped findings you can put in front of your legal adviser.
When it is needed
Unauthorised use of a company workstation, suspected remote access, an employee leaving with doubts about files taken, unapproved software installed — or simply understanding what actually happened after an incident. In every case, haste destroys evidence: a machine switched back on "just to check" writes hundreds of files and overwrites timestamps.
A method that protects the evidence
The device is photographed, placed under a numbered seal, then copied bit for bit without ever being booted. SHA-256 hashes are taken before and after the work: if they match, it is demonstrated that nothing was altered. The analysis is then carried out exclusively on the copy, and every operation is recorded in a timestamped log appended to the report.
What the traces reveal
Software installed and actually executed, remote access tools and their connection logs, local and remote logon sessions, USB devices with their serial numbers, downloaded files, accounts created and privileges granted. Every finding cites its technical source: evidence of execution is not evidence of installation, and the reverse is equally true.
Within a proper legal framework
The work requires written authorisation from the owner of the equipment. Files an employee has marked as personal are never opened on my own initiative. The report records technical facts: it makes no legal assessment and names no one. This rigour is not excessive caution — it is what makes your findings usable.
// faq
Frequently asked questions
Am I allowed to have an employee's computer analysed?
You may verify how your own equipment is used, provided the measure is proportionate and that files identified as personal are not opened outside the employee's presence. Before any work begins, I provide a mandate for you to sign and set out the points to secure: IT policy, employee information, and consultation of the works council.
Will the report stand up before an employment tribunal?
It is built for that: timestamped facts, a described method, acknowledged limits and a documented chain of custody. If proceedings are seriously contemplated, I recommend involving a commissaire de justice (judicial officer), whose formal record carries evidential weight that a private report never will. I say so upfront rather than afterwards.
How long will the machine be unavailable?
For the duration of the imaging, usually a few hours. The equipment is then returned to you against a signed receipt: the analysis continues on the copy, without depriving you of the hardware.
What if the disk is encrypted?
A recent Windows machine is often protected by BitLocker. The recovery key is then essential and must be retrieved before the disk is removed — without it, the device is unreadable. That is the first point we check together.
// other services