CFL Digital Forensics Services Brochure

Computer Forensics Lab CFLAB . U K · LONDON DIGI TA LFORENSICS · E - DISCOVERY · EXPERTWITNESS Digital evidence you can rely on in court. Independent forensic examination of computers, mobile devices and cloud accounts for law firms, corporate counsel, litigators and company directors across the United Kingdom. ABOUTTHELAB Technically reliable. Legally defensible. Clearly communicated. What sets our reports apart "Digital evidence must be technically reliable, legally defensible and clearly communicated. We work with clients from the earliest stage to define the issues and set the forensic strategy." WHOWEWORKWITH 2007 NPCC UK-wide ISO 17025 ALIGN ED PRAC TI C E ACC EP TED METHODOLOGY From seizure to courtroom: a defensible forensic process. Standards we work to Where the evidence lives CASE CORESERVICES One lab. The full evidential lifecycle. Criminal defence and prosecution Civil, regulatory and employment CORPORATEINVESTIGATIONS Establish the facts. Keep the evidence. Typical questions we answer LITIGATIONSUPPORTANDELECTRONICDISCOVERY Large data. Defensible process. Practical scope. CORPORATEE - DISCLOSUREINPRACTICE Mid-market matters. Full-scale rigour. CASE A CASE B Departing director, clients and trade Shareholder dispute in a PE-backed secrets business CASE C CASE D Supplier fraud and procurement Commercial contract dispute investigation COMPUTERFORENSICSLAB · E - DISCLOSUREINPRACTICE06 Precision where it counts. CASE E CASE F Workplace misconduct and executive M&A due diligence and post- investigation acquisition dispute Typical mid-market corporate e-disclosure scope ORGANIS AT IONSIZECUSTODIANSD ATA VOLUMEM AT TER VA LUE 5 to 15 250GB to 2TB £250k to £5m 15 to 30 1TB to 5TB £1m to £25m "In a mid-market dispute the question is rarely whether the data can be reviewed. It is whether the right custodians, sources and issues were identified at the outset, so that the review is proportionate and the findings survive challenge." COMPUTERFORENSICSLAB · E - DISCLOSUREINPRACTICE07 EXPERTWITNESSSERVICES Independent. Clear. Relevant. What every report contains Areas of specialist skill WORKINGWITHUS Instruct early. Preserve first. Scope proportionately. When to call How an instruction runs 1. Initial call. Free, confidential discussion of the issues and 2. Scoping letter. Clear questions, fixed or estimated fees, 3. Preservation and collection. On-site or in the lab, with 4. Examination and interim findings. Early feedback so 5. Report and support. Court-ready report, exhibits, Preserve the evidence: first hours returned, reissued or wiped "The most common reason digital evidence fails is not the technology. It is what happened to the device in the days before anyone thought to call an expert." DIGITALFORENSICS · E - DISCOVE RY · EXPERTWITNESS GETINTOUCH Talk to an expert before the evidence changes. TELEPHONEEMAIL WEBLAB