Hacking, surveillance, data loss, compromised account…Digital forensics for individuals in Switzerland

Do you have doubts about a device, an account or your digital data?

We analyse the available traces to understand what happened, verify the facts and explain the possible conclusions to you clearly.

Monitored phoneHacked accountSuspicious emailLost data

Request a quoteWhat should I do first?

If you are in immediate danger or under physical threat, call the police on 117.

We are not an emergency service: our work is analysing data, not intervening in dangerous situations.

Act now

What to do before contacting us

Some actions can alter or erase traces that are useful to the analysis. If you suspect hacking, surveillance or data loss, here is what to do first, before you take any action yourself.

  1. 1

    Do not switch off or reset the device

    Switching off or resetting a device can alter or delete traces that are useful to the analysis. Where possible, disconnect it from the network but leave it switched on, and avoid any reset until you have agreed on the right precautions with an expert.

  2. 2

    Do not delete messages

    Keep any messages, emails and notifications that seem suspicious. They may contain useful information for understanding what happened and provide a starting point for the analysis.

  3. 3

    Keep what alerted you

    Messages, notifications, unknown logins or unusual behaviour: keep them where possible and note the date you noticed them. Do not delete the originals after taking a screenshot.

  4. 4

    Avoid unnecessary handling

    Do not uninstall apps, do not run cleaning tools and avoid changing the device any further. Every action can alter traces and make it harder to reconstruct what happened.

  5. 5

    Avoid any hasty confrontation

    If your suspicions involve another person, put your safety and the preservation of the available evidence first. A premature confrontation can change the situation or lead to the deletion of data that could have been useful to the analysis.

  6. 6

    Note what you have already done

    Password changes, restarts, deletions or uninstalls: note the actions already taken and, where possible, when. This helps us tell your own actions apart from the events we are trying to analyse.

Understand

What can a forensic analysis do in your situation?

A forensic analysis examines the traces left on your devices, accounts or files to answer a specific question: was there any access, modification, deletion or abnormal behaviour that can be established technically?

  1. 1

    Establish what actually happened

    We look for traces that make it possible to date and understand events: logins, linked devices, account access, applications, files and other relevant activity.

  2. 2

    Rule out false leads too

    A battery that heats up, a phone that slows down or an unusual advert is not enough to prove a compromise. The analysis also shows when no technical evidence supports the initial suspicion.

  3. 3

    Get conclusions you can understand

    You receive a clear account of the analyses carried out, the findings and their limitations. Depending on the engagement, these conclusions can also be documented in a written report.

How can we help you?

Is your situation different?

Every case is unique. Tell us what worries you, which device or account is involved and what you want to find out: we will tell you what an analysis can establish.

Describe your situation
Our analyses

Our main forensic analyses for individuals

Phone or computer, online account, lost data, suspicious email: these are the four requests we receive most often. Since every situation is different, we can also design an analysis tailored to your needs.

  1. 1 / 4

    Hacked or monitored device

    Your situation

    I think my phone or computer has been hacked or is being monitored.

    Objective

    Look for traces on your phone or computer showing whether someone has accessed or is monitoring it, since when and by what means.

    What we do

    • We examine the installed applications, their permissions and the device settings.
    • We look for traces that could reveal malware or a monitoring tool.
    • We analyse the device's connections, communications and unusual activity.
    • We look for suspicious changes or actions and try to place them in time.
    • We cross-check what we observe to establish what it does, or does not, allow us to conclude.
  2. 2 / 4

    Hacked or monitored online account

    Your situation

    I think my online account has been hacked, or that someone has access to it.

    Objective

    Look through your account history for traces showing whether someone else has logged in, when, and what may have been viewed or changed.

    What we do

    • We analyse the login history to identify unusual access, devices or locations.
    • We look for devices, sessions and applications still linked to the account.
    • We check for security or configuration changes made without your knowledge.
    • We examine the permissions granted to external applications or services.
    • We look for traces showing which data may have been viewed, sent, changed or deleted.
  3. 3 / 4

    Recovery of lost data

    Your situation

    I have lost or deleted my data (photos, documents…) and would like to get it back.

    Objective

    Assess what can still be recovered when files have been deleted, corrupted or made inaccessible, while limiting any operation likely to alter the storage medium further.

    What we do

    • We assess the condition of the storage medium and the chances of recovery.
    • We preserve the data still present before going any further.
    • We look for deleted, corrupted or inaccessible files.
    • We check that the recovered items are readable and intact.
    • We return the recoverable data to you in a usable format.
  4. 4 / 4

    Analysis of a suspicious email

    Your situation

    I have doubts about who sent an email, or a message I never sent is being attributed to me.

    Objective

    Analyse the technical information in the message to assess its origin, its authenticity and any signs of forgery or impersonation.

    What we do

    • We retrieve and analyse the technical information contained in the original message.
    • We reconstruct the route the email took before it reached you.
    • We check the elements that help assess the sender's identity.
    • We look for any signs of impersonation, forgery or tampering.
    • Where necessary, we analyse suspicious links or attachments in a suitable environment.

Your situation doesn't fit any of these?

Simply describe your issue and what you want to understand. We will assess your situation and point you to the most suitable analysis.

Talk to an expert
The scope of our work

What we don't do

Every digital investigation needs a clear framework. Before we start, we check that you are entitled to entrust us with the devices, accounts or data concerned, and that the request falls within our area of expertise.

  • Analyse another person's data

    We do not work on a third party's device, account or data when you are not entitled to entrust them to us.

    What we can do instead

    Analyse your own devices and accounts, or assess with you whether your situation allows us to act.

  • Put someone under surveillance

    We do not install any tool for spying on, tracking or monitoring another person's activity.

    What we can do instead

    Look for traces of possible surveillance on your own devices.

  • Recover access to a lost account

    Account recovery generally has to go through the procedures provided by the service provider.

    What we can do instead

    Analyse the available traces to determine whether the account was compromised, and document what happened.

  • Identify the person behind an anonymous account

    The data available to an individual does not always make it possible to identify the person behind a pseudonym, an address or an account.

    What we can do instead

    Analyse and document the available technical evidence so that it can be used in your own steps.

Check whether your request falls within this scope
How it works

What happens, in practice?

  1. 1

    A first conversation

    You describe the situation to us. This conversation is free, confidential and without obligation. It helps us understand what you want to find out.

  2. 2

    A quote and a feasibility assessment

    We tell you what is technically possible, what is not, and what it will cost. Nothing starts without your written agreement.

  3. 3

    Analysis in our lab

    You entrust us with the device or files. We work on a copy, on our premises in Switzerland. You are kept informed of progress.

  4. 4

    Reporting back

    We return your belongings and explain the results in person, with a written report you can understand without technical knowledge.

Want to understand our method in detail? Discover the six steps of a forensic analysis

Confidentiality

What happens to your devices and data

Your belongings are logged on receipt and kept in a secure location. We work on a copy, on our premises in Switzerland, on machines we own: your data never goes to a third-party provider. Only the people handling your case have access to it, and we are bound by professional secrecy. At the end of the engagement, your equipment is returned to you and the working copies are deleted as agreed with you.

Stored in Switzerland

Extended engagement

An in-depth investigation, tailored to your situation

Some situations cannot be resolved by checking a single device. We also carry out extended engagements, over time and with complete discretion.

  • Several devices, several accounts

    Phones, computers, tablets, email and storage accounts: the analysis covers your whole digital environment, not a single isolated item.

  • Your family or home environment

    Home router, connected devices, cameras, location sharing and linked accounts: so many forgotten entry points that often explain what seemed inexplicable.

  • Coordination with your lawyer

    When your case is already in the hands of a lawyer, we work with them: technical questions defined together, and a report written in a form that can be used in proceedings.

  • Results delivered in person

    Return of your equipment and presentation of the conclusions at a dedicated meeting, with all the time needed to answer your questions.

Frequently asked questions

The questions we are asked most often

In the vast majority of cases, yes. Consumer spyware leaves technical traces: hidden apps, abnormal permissions, configuration profiles, connections to known servers. A forensic analysis can identify them, date their installation and sometimes determine their origin.Be aware, however, that surveillance does not always rely on an app. Access to your iCloud or Google account, or a shared device, is sometimes enough. That is why we also examine your accounts and their login activity.If you suspect you are being monitored, contact us from another device and don't delete anything: uninstalling erases evidence and may alert the person monitoring you.

Describe your situation

The more precise your description, the more precise our answer. The first conversation is free and without obligation.

Request a quoteWhat should I do first?

Confidential conversation, free quote before any cost is incurred

Representing a company?

Data leak, employee departure, disputed document, compromised Microsoft 365 environment.

Acting in the context of legal proceedings?

Unsealing, court-ordered expertise, private technical analysis and counter-expertise.