Forensic expertise for lawyers, courts and judicial authorities

Unsealing, court-ordered expertise, private technical analysis, report review or counter-expertise…

We analyse digital data to establish the facts, test the competing hypotheses and reach documented, verifiable technical conclusions.

Request a feasibility assessmentSee our services
Understand

What is forensic expertise used for in proceedings?

We collect, preserve and examine digital data in order to formulate and test hypotheses that answer the questions set out in the mandate. Where hypotheses already exist, we can also assess how well they hold up against the available technical evidence.

  1. 1

    Framing the technical question

    Every expert assignment starts from a mandate and precise questions. We define the scope of the analysis and, where necessary, clarify the technical questions before the investigation begins.

  2. 2

    Testing the hypotheses

    A technical result is never interpreted on its own, in isolation. Our team examines the various explanations consistent with the data, including those that may contradict the initial hypothesis.

  3. 3

    Documenting verifiable conclusions

    Method, sources, operations performed, results and limitations are documented so that the findings can be understood, discussed and, where possible, reproduced.

Do any of these situations sound familiar?

Is your situation different?

Every case raises its own questions. Tell us about your context, the evidence available and your objective: we will tell you which analyses are possible.

Discuss your case
Our services

Our forensic expertise in legal matters

Unsealing, court-ordered expertise, private technical analysis or counter-expertise: each mandate answers precise questions and leads to documented findings, together with their interpretation and the limits of the analysis.

Sorting of sealed data

“Data is under seal and must be sorted to exclude anything covered by privilege.”

Objective

Carry out a traceable and reproducible technical sort according to the criteria set in the proceedings, in order to identify which data falls within the authorised scope and which does not.

Example activities

  • Definition of the sorting criteria
  • Forensic imaging of the data
  • Processing and indexing
  • Application of the sorting criteria
  • Quality review
  • Production of the deliverables and a report

Expertise ordered by a criminal authority

“An authority needs answers to technical questions about digital data.”

Objective

Answer the technical questions set out in the mandate independently, and assess to what extent the observed results support each of the hypotheses under consideration.

Example activities

  • Analysis of the mandate
  • Understanding and, where needed, rephrasing the questions
  • Formulating working hypotheses
  • Analysis plan
  • Acquisitions and investigations
  • Assessment of the results against alternative hypotheses
  • Expert report

Private technical analysis and support for counsel

“I need to make use of technical data (phone, extraction, messages…) to prepare a defence or a civil claim.”

Objective

Provide counsel with a documented technical reading of the available evidence and answer the questions relevant to preparing the case.

Example activities

  • Scoping interview (questions, scope, limits)
  • Feasibility assessment before any cost is incurred
  • Targeted acquisition
  • Technical investigation
  • Interpretation of the results
  • Technical report

Report review

“An expert report has been added to the case file and any usable grounds for challenge must be identified.”

Objective

Examine the method, data and reasoning of the expert report to verify whether its conclusion holds, and identify any limits, inconsistencies or usable grounds for challenge.

Example activities

  • Receipt of the report and technical exhibits
  • Methodological analysis
  • Checks: reproducibility, validity of methods…
  • Reasoned note of challenge

This service requires no new acquisition: we work on the report and technical exhibits already in the case file.

Your case doesn't fit any of these?

Tell us about your context, the evidence you hold and your objective: we will tell you which analyses are possible and under what conditions.

Talk to an expert
Scope

The digital evidence and data we can analyse

Phones, sealed media, messaging, documents, media files or technical reports: we examine the evidence available under the mandate to determine what it can establish and where its limits lie.

Phones and extractions

Mobile devices and their extractions, often the central technical exhibit in a criminal case.

MessagesCall logsApplicationsGeolocationDeleted files

Sealed media

Computers, drives and removable media placed under seal by the authority.

PhonesComputersHard drivesUSB drivesMemory cardsDisk images

Messaging and online accounts

Communications and connection traces, where accessible under the mandate.

MailboxesCloud accountsLogin historiesShares

Documents and exhibits

The files themselves, whose internal structure reveals changes and tampering.

MetadataOffice filesPDFTraces of modification

Audio and video media

Recordings produced as evidence, and signs of generation or editing.

Audio recordingsVideosRe-encoding artefactsContextual verification

Technical reports

Expert reports and technical exhibits already in the case file, to test their method.

Expert reportsTechnical exhibitsMethodologyReproducibility

The exhibit or data source you want examined isn't listed here? Tell us about your case: we assess the technical feasibility of the analysis and its conditions before any work begins.

Process

How an engagement works

Six stages, from first contact to the report.

  1. Together we define the questions to be answered, the scope of the engagement and the applicable legal framework. Where needed, we rephrase the questions, always with your agreement, so that the results are relevant and usable.

    At the end of this conversation, we tell you clearly what is technically achievable, where the analysis will reach its limits and what results you can reasonably expect.

  2. We quickly secure workstations, mailboxes and logs to prevent any loss or alteration of data. This step is essential: some digital traces, particularly in the cloud, are only retained for a limited time.

    A restart, a reinstallation or the deletion of a compromised account can permanently destroy elements the analysis needs. Preserving the traces from the outset is what makes the investigation reliable and usable.

  3. We make a forensic copy of the medium without altering the original data. Its integrity is checked and verified by hash, and all analyses are then carried out on the copy.

    This method guarantees the integrity of the evidence and allows a third party to verify and reproduce our findings.

  4. We analyse the traces left by systems and applications to reconstruct events: logins, transfers, deletions, external media, cloud activity...

    Each element is placed in a timeline and linked to its technical source.

  5. We test each finding against the alternative hypotheses, including those that could call it into question.

    This assessment measures the real weight of the technical evidence and avoids hasty conclusions.

  6. We deliver a clear and usable report, including the timeline of events, the technical evidence, our conclusions and recommendations.

    The report separates what is established, what is probable and what cannot be concluded, and we then walk you through it.

Deliverables

Deliverables tailored to the mandate

Depending on the nature of the assignment, we produce the documents, data and technical material needed to understand and verify our work.

  • Courts

    Expert report

    Questions addressed, method, sources analysed, results, interpretation and limits, in a document designed to remain understandable to a non-technical reader.

  • Courts

    Sorting deliverables

    In an unsealing procedure: datasets and documentation that trace how the defined sorting criteria were applied.

  • Lawyers

    Critical analysis note

    In a report review: analysis of the methodology, sources, reasoning and conclusions to identify inconsistencies, limits or points requiring verification.

  • Lawyers

    Technical report

    Questions addressed, methods used, sources analysed, results, interpretations and limits of the analysis, brought together in a clear, structured document.

Our guarantees

Why entrust your investigation to SecuLabs

  • A rigorous methodology

    Our investigations rely on recognised methods and frameworks, adapted to the nature and stakes of each case.

  • Preserved and traceable evidence

    Forensic copies, hash verification and chain of custody guarantee the integrity and traceability of the evidence analysed.

  • Strict confidentiality

    Data, sealed items and case materials are kept securely in a safe and are accessible only to authorised staff.

  • Expertise recognised in proceedings

    Our experts work with lawyers, courts and authorities, with reports designed to be understood, discussed and defended.

  • An independent methodology

    No dependence on third-party software: our conclusions rest on the observed data and are verified by several methods where necessary.

  • Clearly established conclusions

    We distinguish what the data demonstrates, what it suggests and what it does not allow us to conclude.

Chain of custody

How we preserve the evidence and data entrusted to us

From the moment they are received, media and data are identified and their handling is documented. Depending on their nature, we carry out the appropriate forensic acquisitions and integrity checks, restrict access to authorised staff and log every significant operation until the evidence is returned or handled as agreed at the end of the mandate.

Stored in Switzerland

Build the skills

Our training: give your teams the right reflexes

Most evidence disappears in the first few hours, wiped by well-meaning internal teams. Our courses teach them what to do instead.

Forensics · SOC / CSIRTCode: OFD-320Duration: 2 days

Malware Forensics

Run a full forensic investigation around a ransomware case, from the initial intrusion through to the analysis of its impact and the technical artefacts left on the compromised environment.

View the course
InvestigationCode: OFD-210Duration: 1.5 days

OSINT & Digital Investigations

Learn to search, cross-check and analyse open-source information in order to turn digital traces into actionable intelligence.

View the course
GRC · ResilienceCode: GRC-110Duration: 1 day

Business Continuity Management

Anticipate critical disruptions, structure your business continuity and prepare your organisation to maintain or resume operations in the face of a crisis, cyber included.

View the course
See all courses
Frequently asked questions

What lawyers and authorities ask us

Yes. We act both on private mandates (companies, individuals, lawyers) and on mandates from a criminal or civil authority. Our acquisition and documentation method is the same in both cases; what changes is the procedural framework, the instructing party and the billing arrangements. We adapt our work to the status of the mandate.

Tell us about your case

We will tell you what an expert analysis can establish, what it cannot, and how long it will take.

Request a feasibility assessmentExplore the practice

Confidential conversation, feasibility assessment before any cost is incurred

Corporate

Data leaks, departing employees, disputed documents, compromised Microsoft 365 environments.

Individuals

Compromised device or account, suspicious email, personal data recovery.