Mobile phone forensics
Mobile phones contain more information about a person's activities than almost any other source. Call logs, SMS messages, WhatsApp and other messaging app data, emails, photos, videos, location history, app usage and more. Even when messages have been deleted, they often remain recoverable on the device.
- WhatsApp, Telegram, Signal and other messaging app extraction
- Deleted SMS and call log recovery
- Contact lists and calendar data
- Photos, videos and audio files including deleted items
- Location history and GPS data
- Social media application data
- Browser history and search records
We work with both Android and iOS devices. The extent of recovery depends on the device, the operating system version and whether the phone has been factory reset. We assess each device individually and advise on what is recoverable before you commit to the full extraction.
Computer forensics
We image hard drives and SSDs and examine the data in a forensically sound manner. This means the original device is not altered during analysis, and our process meets the requirements for evidence admissibility in South African courts.
- Deleted file recovery from hard drives and SSDs
- Email extraction and analysis
- Document and spreadsheet history
- Browser and internet activity
- USB and external device connection logs
- User account activity and login history
- Installed software and recent file access
Deleted data recovery
When a file is deleted from a device, the data is not immediately removed. The space it occupied is simply marked as available for reuse. Until that space is overwritten by new data, the original file can often be recovered. The sooner we access the device after deletion, the higher the chance of recovery.
This applies to documents, photos, messages, emails and many other file types across phones, computers, tablets and external drives.
Chain of custody and court-ready reports
For evidence to be usable in legal proceedings, it must be collected and handled correctly. We maintain a documented chain of custody from the moment we receive a device to the final report. Our reports explain what was found, how it was found and what tools and methods were used, in language that is understandable to a judge or legal team.
Common use cases
- Infidelity investigations where a device contains communication evidence
- Employee misconduct where workplace devices need examination
- Fraud investigations involving financial records or email communications
- Disputed contracts or communications in business litigation
- Recovery of accidentally deleted personal files
- Child safety concerns involving a minor's device
Confidentiality
All devices submitted to us and the data extracted from them are handled in strict confidence. We do not retain copies of client data after an assignment is concluded. Data is stored securely during the engagement and destroyed or returned in full once the report has been delivered.