Digital evidence examination and technical reporting

What this service covers

When you find spyware, a tracker or a data leak, the first instinct is to get rid of it. But if legal action is a possibility, how the finding is documented matters as much as the finding itself. This service records digital findings in an orderly, explainable way, together with how they were obtained and what they mean.

Let’s be clear about the boundary. What we provide is technical examination and reporting, and technical support to your lawyer in legal proceedings. We do not act as an official court-appointed expert (in Turkish, bilirkişi) and do not replace one. How the report is used in a case is your lawyer’s decision.

When people come to us

• Stalkerware has been found on your phone and you want it documented before removal.
• A device was found in your car or home during a sweep and its technical details need reporting.
• You are experiencing stalking or harassment and want messages, calls and location sharing preserved in an orderly way.
• You suspect an employee copied data before leaving.
• Your lawyer wants the digital findings in a case explained technically.

How we work

Handover and record. Devices are received against a handover record. Condition, visible damage, power state and time are noted and photographed, and every change of hands is documented.

Integrity-preserving copy. Where possible we examine a copy rather than the device itself, recording verification values so it can be shown the data did not change during examination. Not every device allows the same depth of acquisition; with current phones it depends on the model and OS version, and the report says so.

Technical examination. Apps, permissions, logs, files, message and email data and timestamps are analysed with forensic tools. Every trace is assessed for what it shows and what it doesn’t. An app being present, for example, does not on its own show who installed it.

Technical report. The report sets out methods, findings, timestamps and the limits of the examination, explains technical terms and does not overstate conclusions. The aim is that a lawyer or judge reading it can see clearly what was found and what was not.

Preserving evidence now

• Don’t reset the device, delete suspicious apps or install system updates.
• Don’t make new backups over old ones.
• Photograph messages, notifications or settings using another device.
• Don’t touch or move a physical device you’ve found; photograph where it is.
• Contact us from a device other than the one you suspect.
• If your safety is at risk, call 112; the ALO 183 line offers support and referral.

Legal limits and ethics

We only examine devices and data that you own or lawfully hold. We do not gain access to anyone else’s phone or account, and we do not unlock devices without the passcode. For corporate devices we look at your organization’s rights over them and its employee policies first. These limits protect you and the credibility of the report.