Named expert profile
Alistair Ewing: Independent Digital Forensic Expert
An independent digital forensics practitioner and expert witness helping legal teams, organisations and private clients understand technical evidence, its significance and its limits.
Direct expert handling
The expert you speak to remains responsible for your work
Alistair defines the technical questions, remains responsible for the agreed core examination or review and for his report and opinion, and explains the findings throughout the instruction.
Work may involve computers, mobile devices, messaging applications, email, cloud records, electronic documents, digital media or other electronic evidence. Assistance can range from an initial technical review to forensic examination, expert reporting, conferences and support during proceedings.
Alistair is UK based. Suitable work can be delivered remotely, with worldwide travel, including across EMEA, by agreement where the instruction requires attendance.
The approach is independent, question-led and proportionate. Observed facts, technical inference and opinion are kept distinct; evidential gaps and reasonable alternative explanations are identified rather than hidden.
Alistair is also a co-founder and director of Squirrel Forensics Ltd, the company behind The Acorn forensic operating system. Read about The Acorn and the separation between product development and independent casework.
A current professional CV and a statement of experience relevant to the proposed instruction can be supplied after conflict and suitability checks.
Forensic skillset
Broad capability, applied to a defined question
The scope for each matter is matched to the available evidence, jurisdiction and questions to be answered. The headings below describe capability areas, not a promise that every source will contain an answer.
Digital forensic expert evidence
Independent review, examination, explanation and reporting for criminal, civil and tribunal instructions.
Computer and laptop forensics
File-system, user-activity, removable-media, browser, application and operating-system artefacts.
Mobile and messaging evidence
Handset extractions, app databases, conversations, media, timestamps, exports and screenshot limitations.
Email, cloud and documents
Mailboxes, headers, routing, cloud records, document structure, metadata, versions and provenance.
Video, audio and metadata
Digital-file structure, encoding, technical timestamps, continuity and clearly stated specialist boundaries.
Cyber incident investigation
Focused post-incident chronology, affected systems, identity and account activity, and possible data movement.
eDiscovery and collection
Proportionate preservation, forensic imaging, targeted collection, verification and documented hand-off.
Timelines and technical review
Reconciliation of multiple evidence sources while separating device, account and human attribution.
Encryption and technical problem solving
Assessment of encrypted, deleted, inaccessible or unusual evidence sources, with recovery prospects and limits stated before disproportionate work.
Forensic software and training
Design, testing and explanation of forensic workflows, including purpose-built tools where a standard output does not answer the evidence question.
Working approach
Clear reasoning, stated limits
Independent
The opinion follows the available evidence and may support, qualify or disagree with an existing interpretation.
Proportionate
The work is directed to the instructed questions, with stages, assumptions, exclusions and fee drivers defined first.
Understandable
Technical findings and limitations are explained in plain English for lawyers, decision-makers and non-technical readers.
What direct expert access means
- The initial scope and evidence questions are discussed with Alistair.
- Core digital-forensic examination, review and reporting remain under his direct responsibility.
- Changes in scope, evidence condition or likely cost are raised before unapproved work proceeds.
- Conference, written questions, expert discussion and attendance can be separately scoped where required.
Professional boundaries
- No result, recovery, admissibility decision or litigation outcome is promised.
- Opinions stay within the available material and the expert discipline actually instructed.
- Where specialist imagery, audio or another specialism is required, the responsible specialist and separate scope are identified in advance.
- The public enquiry form is not used to transfer evidence or confidential case papers.
Speak to the named expert
Discuss an instruction directly with Alistair
Provide the broad nature of the matter, party names, the relevant deadline and a description of the likely devices or data sources. Do not send evidence; a secure route is arranged only after the conflict, suitability and scope checks.