Forensic Investigations

A forensic investigation is the science of determining who did what, where, when and how. The aim is to intelligently identify evidence, and pinpoint supporting relevant activity that may be of value, in a legally defensible manner. It is a discipline that can encompass a wide range of matters including deception/fraud, misuse of computers, cartel activity, competition law and intellectual property theft.

At Proven Legal Technologies, we capture all information that has the potential for relevance and then interrogate it to determine its relevance to the investigation.

We have the ability to investigate anything from a single computer, to a complex IT system or combination of systems, a smart phone or a tablet. All accessible material, including files and folders, deleted files, internet activity and other system files that can be used to determine user activity is incorporated into our investigation.

All investigations conducted by our team adhere to the Association of Chief Police Officers’ (ACPO) guidelines on digital evidence. Failure to collect evidence in the proper manner can result in it being deemed inadmissible and our experts’ thorough knowledge of both IT and court procedure ensures this never happens.

PLT also provides an outstanding expert witness service, and our experts have given evidence on numerous occasions in the High Court, the Court of Appeal and the International Court of Justice.

We are also well-versed in the execution of Civil Search Orders, incident response and the interrogation of documents or emails to determine their veracity.


Civil Search Orders and Delivery-Up Orders give solicitors the power to obtain pertinent information from persons suspected of having committed acts that may result in litigation.  The authority to search residential and business premises, or to demand the handover of relevant materials or computer devices, can produce critical evidence and intelligence to support the litigation.

Very often, the information is in electronic format, and not always in the obvious locations.  It is, accordingly, vital that a computer forensic expert is consulted as early as possible to advise what data is likely to reside where, how to accommodate it in the wording of the Order and how to manage it during the execution.

Proven Legal Technologies has extensive experience in assisting in Civil Search and Delivery-Up Orders, as well as dawn raids and doorstep imaging. Our professionals can image a range of devices on-site, or seize devices for preservation.

Seized or received devices can be stored for preservation within our secure lab and imaged for forensic investigation or e-disclosure review, greatly reducing the time spent on-site. PLT ensures that a complete chain of custody is maintained from the moment the evidence is collected, whilst contemporaneous notes and photographs are taken throughout the search to ensure the evidence is appropriately handled.

Computer forensics is the science of investigating legal evidence stored in computers and digital storage media. Our experts can intelligently identify digital sources of evidence and collect or image the data for preservation, analysis and presentation.

All evidence must be forensically captured, and all data relevant to the investigation analysed, in accordance with the Association of Chief Police Officers’ (ACPO) guidelines. This ensures that any evidence is defensible in court and requires a complete understanding of all areas in which evidence is likely to be stored. Not every case is a criminal matter, but at PLT every forensic collection and investigation is conducted to a criminal investigative standard, even if the requirement is in response to civil litigation. This ensures complete defensibility.

Every document created and any activity conducted with a computer leaves a trail of evidence.  For example, deleting a computer file does not necessarily mean that all traces of it are removed forever. Often the deleted data remains on the internal memory storage of the computer and, with the right skills and tools, can be recovered and provided for review at a later date.

Proven Legal Technologies’ professionals have experience of a wide range of matters, including validating documents and forgeries, deception/fraud, misuse of computers, cartel activity, competition law, intellectual property theft, network intrusion and a variety of other allegations or suspicions.

Proven Legal Technologies has vast experience in helping global corporates, international law firms and individuals investigate and respond to leaks of information and breaches in security. Our incident response team can manage the aftermath of a cyber-attack or information leak whilst ensuring the highest level of confidence is maintained and the sensitivity of client data is preserved.

Our experts have conducted investigations on devices running a variety of operating systems, including Windows, Macintosh and Linux. PLT’s work not only involves the analysis of the devices themselves, but also analysis of the network and the active devices that connect to it to identify how they communicate. The team has also produced information from publicly available sources such as Twitter, Facebook or other social media forums that has been successfully used as evidence in court. PLT experts have also regularly acted as expert witnesses on related matters.

During any regulatory response or forensic investigation, our experts take contemporaneous notes to support any later requirement for expert opinion, affidavits or oral testimony.

In our experience, it is rare for testimony to be required as forensic evidence usually leaves little room for ambiguity. When the situation does arise, however, our professionals are able to provide an expert report, affidavit or oral testimony stating the evidentiary facts and discussing the details of the evidence to justify their conclusions and opinions.

Proven Legal Technologies has, on occasion, managed to show that reports from other experts have contained material errors or assumptions. When discussed during experts’ consultation exercises, these errors have been corrected by the experts who made them, and the conclusions drawn significantly amended.

Smart phones and tablets are fast becoming integral to everyday life and can store vast amounts of evidence including text and e-mail messages and even Facebook chat. Smart phones now account for over 50% of the global market and, while leading brands continue to release updated versions, the lesser known manufacturers are catching up and diversifying the market.

Proven Legal Technologies has the experience and specialised forensic tools to support the extraction and investigation of over 5000 mobile devices, including Blackberry, iPhones, iPads and other smart devices. We provide in-depth physical analysis of the data stored in the smart device, including, where possible, deleted information such as communications, files and geographical location history.

The collection of data is a crucial step in any forensic investigation, regulatory inquiry or e-disclosure project. Working on the original data is an extremely risky strategy as something as simple as just switching on a computer can have serious consequences.

Forensically collecting or imaging computer media is a secure way to capture data, while still preserving the original evidence in its entirety. Even if a case is not a criminal matter, any data that may be used as evidence in court should be collected according to the Association of Chief Police Officers’ (ACPO) guidelines to maintain its integrity and authenticity.

Our trained forensic investigators can then examine the evidence in full on an exact replica of the original, while still maintaining data integrity.

Proven Legal Technologies’ experience with data collection includes Civil Search Orders, dawn raids, Delivery-Up Orders, web-based e-mail collections and covert computer and network collections. We can consult on the technical aspects of gaining access to data held by a third party, whether that be instructions on what needs to be delivered-up for imaging, or on evidence available to obtain a Search and Seizure Order or specific disclosure.  We have the ability to collect a vast range of digital media including personal computers/laptops, smart phones and tablets, external media and servers.