Every source, collected in a way that survives challenge.

Answers to the questions counsel ask most.

How do you collect WhatsApp messages as evidence for UK court proceedings?

By forensic acquisition of the device rather than by screenshot. We take a logical or full file-system extraction of the handset, parse the WhatsApp database, and recover messages, attachments, timestamps, participants, edits and, where the artefacts survive, deleted content. The result is hash-verified, documented in a chain-of-custody record and exported in a reviewable, threaded format with the original database preserved. Screenshots and forwarded chat exports are admissible in principle but weak: they carry no metadata, are trivially editable, and invite an authenticity challenge.

How is Microsoft Teams data collected for disclosure?

Through the Microsoft 365 compliance and Graph interfaces rather than by exporting from the client. One-to-one and group chats are stored in the participants' mailboxes, channel messages in the team's group mailbox, and shared files in SharePoint or OneDrive, so a defensible Teams collection is really three collections reconciled together. We collect messages, attachments, edits, deletions where retained, reactions and call metadata, and we record the tenancy retention settings, because they determine what could still exist.

Can deleted messages be recovered from an iPhone for litigation?

Sometimes. Deleted records may persist in unallocated database space, in write-ahead logs, in recently deleted containers, in an iCloud or iTunes backup, or on a paired device. Recovery depends on the iOS version, the elapsed time, the volume of subsequent activity and whether the handset was encrypted or reset. The honest answer is that deletion is often recoverable within days and rarely recoverable after heavy use. We test rather than promise, and we report what was and was not recoverable.

How do you preserve Slack data for an investigation?

By placing a legal hold in the workspace where the plan supports it, then exporting through the Slack Discovery or export API rather than by scrolling the client. We capture public and private channels within scope, direct messages, files, edits, deletions and shared links, with user and channel metadata, and we reconcile the export against the workspace audit log so gaps are visible rather than silent.

Do you need to take an employee's device away?

Usually not for long. Most collections are done on site in under two hours per device, or remotely with the custodian present on a call. Where a full physical image of a laptop is required, we image on site overnight or provide a loan machine. For personal devices we take a scoped, consent-based logical extraction and document exactly what was and was not acquired.

What about data held in the cloud by a third party?

Cloud content is collected through the provider's administrative and compliance interfaces under the account holder's authority, not by scraping. Where the account holder will not cooperate, a court order or a Norwich Pharmacal-type application against the provider may be needed, and we scope realistically before anyone spends money on an application.

Can you collect from a server without shutting the business down?

Yes. Targeted, live acquisition of the relevant shares, mailboxes or database exports is the norm; full physical imaging of production servers is reserved for cases where the file system itself is in issue. Collection is scheduled outside business hours where the load matters.

What is the most commonly missed source?

Chat. Teams, WhatsApp, Signal and Slack now carry the conversation that email used to carry, and they are routinely left out of a search that was scoped around mailboxes. The second most commonly missed is the departed employee whose mailbox was deleted 30 days after leaving.