For solicitors, counsel and legal teams
Digital Forensics for Solicitors and Legal Teams
Independent digital forensic support for criminal, civil, commercial, employment and tribunal matters. Alistair Ewing is the principal contact for conflict and suitability checks, scoping and the agreed work. Any supporting provider or separate specialist is identified before involvement.
Current CV available privately after conflict and suitability checks · No evidential files through this website
Choose the procedural setting
Civil and criminal evidence need different routes
The evidence questions may overlap, but the procedure, served material, funding and report duties do not. These focused guides explain what to preserve, what helps an initial estimate and where independent technical review may add value.
Digital evidence in civil litigation
For civil proceedings in England and Wales, including preservation, electronic disclosure, CPR Part 35 reports, questions and single joint instructions.
Digital evidence in criminal proceedings
For criminal proceedings in England and Wales, including police extraction review, computer and message evidence, Legal Aid estimates and CrimPR Part 19.
When technical input may assist
Start with the disputed proposition
A useful instruction identifies what the digital evidence is said to establish, which sources are available and what decision or proceeding the answer must inform.
Existing analysis needs testing
Review whether a report, extraction, schedule or opposing interpretation is supported by the underlying material and method.
Chronology or provenance is disputed
Examine timestamps, file history, message context, transfers, deletion and application or system behaviour.
Evidence needs preserving
Plan proportionate imaging or targeted collection before devices, accounts, retention periods or routine use change relevant records.
Questions commonly instructed
- Does the reported material fairly represent the available source and surrounding context?
- Are timestamps, totals, deleted records and tool labels interpreted correctly?
- What can device, account, email, document or messaging artefacts establish about sequence and provenance?
- Are alternative explanations or material limitations missing?
- Would a focused review answer the issue, or is further acquisition and examination proportionate?
Potential material
- Reports, Streamlined Forensic Reports (SFRs), schedules, extraction packages and acquisition notes.
- Computers, mobile devices, forensic images and defined storage media.
- Native messages, mailboxes, electronic documents and digital media files.
- Relevant account, cloud, system or audit records where lawfully available.
- Letters of instruction, pleaded issues, key dates and the required output.
Outputs matched to the stage
From preliminary advice to formal evidence
- Initial feasibility or proportionality advice after a properly scoped instruction.
- Conference, advisory review or written questions seeking clarification.
- Independent technical memorandum or expert report where justified.
- Responses to questions, expert discussion and joint statement where applicable.
- Court or tribunal attendance when required and separately estimated.
The appropriate expert duties and procedural requirements are confirmed for the jurisdiction and instruction. Technical analysis does not decide the legal issues reserved to the court or tribunal.
Official procedural sources
Rules to check for the instruction
Civil proceedings
For civil proceedings in England and Wales, see the Ministry of Justice’s Civil Procedure Rules Part 35: Experts and Assessors. The applicable duties and permissions still depend on the particular instruction and order.
Criminal proceedings
For criminal proceedings in England and Wales, see the official Criminal Procedure Rules 2025, Part 19: Expert Evidence. Check the current rule, directions and case-specific timetable.
These links are general procedural references, not legal advice or a substitute for the instructions of the legal team.
Preservation and continuity
Collection planned around the instruction
Collection may be on-site or remote, full or targeted. For a suitable authorised system, remote work may use an encrypted agent while live, or controlled bootable USB or CD media when the system begins switched off. Source state, operator steps, verification, encryption and hand-off are recorded for the agreed method.
Alistair is UK based and available for worldwide travel, including across EMEA, by agreement. Legal authority, cross-border data movement, safety, timetable, equipment movement and cost are considered before attendance.
Conflict, funding and timing
Enough information for a useful estimate
- Party and entity names for the conflict check.
- Jurisdiction, court or tribunal, case reference and relevant dates.
- The questions, existing technical material and proposed output.
- Private, insurer or Legal Aid funding information where applicable.
- Report, conference, hearing or preservation deadlines.
Do not attach evidence, passwords or confidential case papers to the public enquiry. A case-specific route follows only after conflict, suitability and scope checks.
Direct expert access
One accountable technical contact
Alistair scopes the questions, completes or directs the agreed core digital-forensic work within his expertise and remains responsible for his report and opinion. A current CV and a statement of experience relevant to the proposed instruction can be supplied privately for a proposed instruction.
Candid limitations
What digital evidence may not establish
- A device or account record does not automatically identify the human actor or their intent.
- Missing data may reflect scope, retention, acquisition or software behaviour rather than deliberate deletion.
- No result, recovery, admissibility decision or litigation outcome is promised.
- Any separate specialism is identified and separately scoped.
Conflict check first
Request a conflict check and itemised estimate
Send party names, the evidence question, jurisdiction, deadline, funding route and a description of the material held. Do not send the evidence itself.