Direct access to Alistair Ewing
Disputed digital evidence, suspected data theft or a cyber incident? Find out what can be examined, what the work will deliver and the likely cost before you proceed.
Independent UK-based International by agreement
Independent digital forensics and expert witness services
Initial consultation and conflict check free. Substantive work follows an agreed written estimate.
Time-sensitive evidence? Continued use can alter device and account records. Preserve the current state where safe and seek advice before changing anything.
Call 020 3598 9658
70+ cyber-breach investigations
Managing consultant or technical lead across Europe, Africa and the Middle East
120+ independent instructions
For law firms, businesses, private clients and forensic providers
Your expert, not an account manager
Work directly with Alistair Ewing
Alistair is your principal contact and remains responsible for the agreed scope, technical direction and every opinion he signs. If a separate specialist is needed, the estimate names them and explains their role before work begins.
More than 16 years in digital forensics and incident response. UK based, with remote work and travel across EMEA and worldwide by agreement. A current CV and relevant experience statement are available after initial checks.
Independent opinion, clear costs. Findings follow the evidence, including when it does not support your position. Fees pay for the agreed work, not a favourable result.
Start with the evidence
What needs testing, and what evidence is available?
Tell Alistair what the evidence is said to show, what needs testing and what material is available. He can then advise on preservation, scope, timing and likely cost.
Legal evidence and expert review
Independent review, expert opinion and clearly scoped outputs for criminal, civil, commercial, employment and tribunal matters.
Explore legal evidence supportComputer, mobile and communications evidence
Question-led examination of devices, extractions, messages, email, electronic documents and the timelines connecting them.
Choose a device or data serviceCorporate and post-breach investigation
Proportionate preservation and analysis for employee, computer-misuse and cyber incidents, with findings tied to the available records.
Plan an evidence-led investigationCollection, eDiscovery and outsourced casework
Documented on-site or remote collection, technical hand-off and experienced forensic support for a defined task.
Review collection optionsPrivate clients are welcome where there is a clear lawful question and suitable evidence. The initial discussion will confirm whether forensic work is likely to help.
Remote and attended collection
Remote collection for suitable live and switched-off computers
Depending on the source and assurance required, a live system may use a case-specific encrypted acquisition agent. A switched-off computer may be powered into a controlled boot environment from prepared USB or optical media, without starting its installed operating system.
An authorised person at the location or an attending examiner must carry out the physical boot steps. Authority, access, encryption, verification, endpoint controls, hardware compatibility, data volume and hand-off are agreed before collection.
Plan a defensible collectionA controlled first step
What happens after you enquire
The public form collects only enough information to check conflicts, suitability, scope and likely cost. Evidence follows through a case-specific secure route. Initial response usually within 2 to 24 hours. Examination timing is agreed after scoping.
- 01
Talk through the question
Alistair checks suitability, availability and conflicts before evidence is shared.
- 02
Agree scope and cost
A written estimate identifies the work, output, timing and any limits. Secure transfer is then arranged.
- 03
Understand the findings
The agreed examination or review is explained clearly. Additional work needs your approval.
Selected case experience
How different evidence questions have been approached
Examples for legal, corporate and private clients describe the material examined, the work carried out and what could and could not be concluded.
Was a reported message sequence complete and correctly contextualised?
Extraction records and reports were compared to reconcile timestamps, participants, gaps and application behaviour.
What could email and PDF artefacts establish about a disputed history?
Routing, structure, metadata, attachments and surrounding records were reviewed, while provenance was kept separate from authorship.
Which systems and events could be placed into a reliable incident timeline?
Available host, account, network and transfer records were correlated, with visibility gaps and alternative explanations recorded.
Practical guidance
Digital forensics insights by Alistair Ewing
Practical articles explain the choices clients face and link to selected work Alistair has written for other publications.
Practical guide
What is forensic imaging, and when is a full image needed?
A practical comparison of full, logical and targeted acquisition, with verification and evidential limits explained.
Practical guide
How should an employee computer be preserved?
Steps for legal, HR and IT teams before a laptop is searched, reset, reissued or returned to service.
Practical guide
How is a defensible timeline built after a cyber incident?
An evidence-led guide to preservation, chronology, affected systems, possible data movement and visibility gaps.
Before instructing
Practical questions, answered early
Clear expectations protect the evidence, timetable and budget.
Can you estimate the likely fee before work begins?
Yes. After conflict and suitability checks, the estimate can set out the questions, material, assumptions, stages and fee drivers. Substantive evidence review or opinion is paid work.
Can you review another examiner's report without repeating everything?
Often. A focused review can test method, sources, reasoning, omissions and limitations before deciding whether further examination is justified.
Can collection be completed remotely?
Sometimes. Live systems may be suitable for a controlled encrypted agent workflow. A switched-off computer may use prepared boot media with authorised hands at the location. Suitability and assurance needs are checked first.
Will you travel outside the UK?
Yes, subject to agreement. Alistair is UK based and available for worldwide travel, including across EMEA, where authority, data-transfer restrictions, safety, timetable, equipment movement and cost allow.
Can I send evidence with the first enquiry?
No. Share only high-level scoping information and names needed for the conflict check. A secure route is agreed if the instruction can proceed.
Conflict check first
What do you need the digital evidence to establish?
Share the parties, evidence question, deadline and a high-level description of the material, but not the evidence itself.