Speak directly with Alistair Ewing
Alistair Ewing examines digital evidence for law firms, businesses and private clients. Get clear answers about disputed records, suspected data theft or a cyber incident.
Independent UK-based International by agreement
Independent digital forensics and expert witness services
The initial consultation and conflict check are free. Further work needs an agreed written estimate.
Time-sensitive evidence? Using a device or account can change its records. Keep it in its current state where safe and seek advice before making changes.
Call 020 3598 9658
70+ cyber-breach investigations
Managing consultant or technical lead across Europe, Africa and the Middle East
120+ independent instructions
For law firms, businesses, private clients and forensic providers
Your named expert
At a glance
Alistair Ewing leads your case and is your main contact.
- More than 16 years in digital forensics and incident response.
- UK based, with remote work and worldwide travel by agreement.
- A written scope and estimate that names any other specialist and their role.
Alistair is responsible for the technical approach and each opinion he signs. His CV and relevant case experience are available after initial checks.
Independent opinion, clear costs. The report explains what the evidence supports, even if it does not support your position. Fees cover the work, regardless of the outcome.
Start with the evidence
How can digital forensics help?
Digital forensics examines data from devices and accounts to help establish what happened. Choose the service that fits your question, or ask Alistair where to start.
Legal evidence and expert review
Independent expert opinion and report review for criminal, civil, business and employment cases.
Explore legal evidence supportComputer, mobile and communications evidence
Test what a computer, phone, message or document shows, and how it relates to your case.
Choose a device or data serviceCorporate and post-breach investigation
Check suspected data theft, staff misuse or a cyber breach. Preserve key records and assess what they show.
Discuss a business investigationCollection, eDiscovery and outsourced casework
Collect digital records with each step recorded. Get support for a legal review or a defined task in a larger case.
Review collection optionsPrivate clients are welcome, subject to a lawful basis for the work and suitable evidence.
View all digital forensic services
New to the terms? Read the digital forensics and cyber glossary.
Remote and attended collection
How does remote collection work?
Some computers can stay on site during collection. There are two main options:
- A running computer: a tool set up for the case may collect data through an encrypted connection.
- A switched-off computer: an authorised person on site may start it from a prepared USB or CD. This avoids starting its usual operating system.
Permission, access, system limits and data checks must be agreed first. Do not start or install anything before the collection plan is agreed.
Check remote collection optionsA controlled first step
What happens after you enquire?
Send a brief outline, the names of those involved and your deadline. The first reply is usually within 2 to 24 hours. Do not send evidence through the public form.
- 01
Talk through the question
Alistair checks whether he can take on the case and whether he has a conflict of interest.
- 02
Agree scope and cost
Your written estimate sets out the work, cost, timing and any limits. A secure way to share evidence is then arranged.
- 03
Understand the findings
The report explains the findings and their limits. Any extra work needs your approval.
Selected case experience
What have past cases involved?
These examples explain the work and its limits. Each new case needs its own review.
Were the messages shown in full and in the right order?
Phone records were compared to check senders, times and missing messages.
What could emails and PDFs show about a disputed history?
Email routes and file details were checked. A file’s source was kept distinct from its author.
Which events could be placed in a reliable timeline?
Device, account and network records helped put events in order. Gaps and other explanations were recorded.
Practical guidance
Digital forensics insights by Alistair Ewing
Read guides to common evidence questions, along with links to Alistair’s work published elsewhere.
What is forensic imaging, and when is a full image needed?
When to copy a whole drive or collect selected data, and how the copy is checked.
How should an employee computer be preserved?
Steps for legal, HR and IT teams before a laptop is searched, reset, reissued or returned to service.
How is a defensible timeline built after a cyber incident?
How to put events in order after a breach, check for data movement and explain gaps in the records.
Before instructing
What should you know before instructing an expert?
Check the practical details before you commit.
Can you estimate the likely fee before work begins?
Yes. After initial checks, your written estimate explains the work and what could change the cost. Evidence review and expert opinion are paid work.
Can you review another expert's report?
Often, yes. A check of the sources, methods, reasoning and gaps helps you decide whether more work is needed.
Can collection be completed remotely?
Sometimes. It depends on the device, access and your case requirements. Ask Alistair to check your setup.
Will you travel outside the UK?
Yes, by agreement, including Europe, the Middle East and Africa. Permission, local rules, data transfer, safety, equipment, timing and cost must be checked first.
Can I send evidence with the first enquiry?
No. Send a brief outline and the names needed for conflict checks. A secure way to share evidence is arranged if the case can proceed.
Conflict check first
What do you need the evidence to show?
Tell Alistair what needs checking and when you need an answer. Start with a brief outline of the case.