It depends on the scope, but we commit to the timelines we control. We take on the case as soon as possible and carry out the acquisition without delay, because some data disappears over time. We then agree with you on a date for a progress review, and on the level of detail the report needs for your purpose. Most routine cases produce initial usable findings within a few days.
Digital investigation and forensic expertise in Switzerland
Our experts collect, preserve and analyse digital data to establish objective, documented and usable facts.
What is a digital forensic investigation?
Digital forensic investigation means collecting, preserving and examining digital data to understand what happened, reconstruct the facts and identify usable evidence.
Together we define the questions to be answered, the scope of the engagement and the applicable legal framework. Where needed, we rephrase the questions, always with your agreement, so that the results are relevant and usable.
At the end of this conversation, we tell you clearly what is technically achievable, where the analysis will reach its limits and what results you can reasonably expect.
We quickly secure workstations, mailboxes and logs to prevent any loss or alteration of data. This step is essential: some digital traces, particularly in the cloud, are only retained for a limited time.
A restart, a reinstallation or the deletion of a compromised account can permanently destroy elements the analysis needs. Preserving the traces from the outset is what makes the investigation reliable and usable.
We make a forensic copy of the medium without altering the original data. Its integrity is checked and verified by hash, and all analyses are then carried out on the copy.
This method guarantees the integrity of the evidence and allows a third party to verify and reproduce our findings.
We analyse the traces left by systems and applications to reconstruct events: logins, transfers, deletions, external media, cloud activity...
Each element is placed in a timeline and linked to its technical source.
We test each finding against the alternative hypotheses, including those that could call it into question.
This assessment measures the real weight of the technical evidence and avoids hasty conclusions.
We deliver a clear and usable report, including the timeline of events, the technical evidence, our conclusions and recommendations.
The report separates what is established, what is probable and what cannot be concluded, and we then walk you through it.
Three areas of expertise, three moments
Forensic investigation tailored to every situation
Companies, legal professionals or individuals: find the services suited to your situation and the expertise dedicated to it.
- Data is under seal and must be sorted to exclude anything covered by privilege
- An authority or a lawyer needs answers to technical questions about digital data
- An expert report is on file and points of challenge must be identified
- An employee leaves, or an internal document is circulating outside: a leak is suspected
- A document, an audio recording or a video looks suspicious or altered
- A Microsoft 365 account or environment appears compromised
- I think my device or online account has been hacked or is being monitored
- I doubt an email really comes from its sender, or I am blamed for a message I did not send
- I have lost or deleted my personal data and want to recover it
Industry-standard tools, data processed in Switzerland
We use internationally recognised forensic solutions, complemented by tools developed in our own laboratory for specific analysis needs.
The data you entrust to us is processed in Switzerland, on dedicated machines. It never passes through any third-party service and never leaves our infrastructure. Sealed items and case materials are kept in a safe, accessible only to authorised staff.
- X-Ways Forensics
- Cellebrite UFED
- Cellebrite Inspector
- Physical Analyzer
- Guidance Software
- Pegacheck
When an incident strikes, our CSIRT takes over
Forensic investigation establishes the facts. The CSIRT contains the incident and secures the environment. Our teams work together, preserving the traces the investigation needs.
Explore the CSIRT practiceIs an attack under way?
Immediate response by our CSIRT. Don't restart or delete anything: isolate the device from the network and call us.
Request emergency responseOur vision
Emilie's vision, Senior Forensics Analyst.
In the digital world as in the physical one, every action leaves traces. Preserved with integrity and analysed with rigour, the traces that remain become evidence our clients can rely on with confidence.
Build the skills
Our training: give your teams the right reflexes
Explore our courses on digital investigation, forensic investigation and cyber crisis preparedness.
Frequently asked questions
What we are asked most often
If you think your device is compromised, do not switch it off or restart it. Good practice: disconnect it from the network (unplug the internet connection and turn on flight mode), keep it plugged in so the battery does not run down, and lock it.
Yes. Our reports are designed to withstand challenge by the opposing party. We document every step so that our findings can be verified and reproduced by a third party.
The cost depends on the scope, the number and type of media, and above all the questions you want answered. To avoid any surprises, we start with a fixed-price scoping phase: we assess feasibility, clarify your objectives and give you a quote for the next steps. You then decide, with full knowledge and step by step, how far to take the investigation.
Your data is kept only for as long as strictly necessary, then destroyed in a documented way. Images and raw data are deleted after the report is delivered, within a timeframe agreed with you, unless instructed otherwise or proceedings are ongoing. We keep only the report and its traceability records, in line with our legal obligations.
Need a question about data settled?
Describe your situation. We will tell you what an analysis can establish, what it cannot, and how long it will take.
Confidential conversation, feasibility assessment before any commitment