What a digital forensic examiner actually does (and doesn't do)
A plain guide for solicitors, accountants and business owners: what digital forensics can establish, how evidence is preserved, and what to ask.
Mark Whittley · 8 November 2026
Solicitors, accountants and business owners often ask us the same question in different ways: “Can you find out what happened on this computer?” Usually the answer is yes. But it helps to understand what digital forensics is, what it can and can’t show, and why the way it’s done matters as much as what’s found.
Forensics isn’t IT support
An IT technician’s job is to make systems work. A forensic examiner’s job is to find out what happened on them, without changing them, and to explain it in a way that stands up to scrutiny.
That difference matters. Logging into a computer, opening files or running a virus scan all change the record. Done before a forensic copy is taken, they can make evidence harder to rely on and easier to challenge.
What we actually do
Preserve. We make a forensic copy of the device or account, an exact, verified duplicate, and work from that. The original is left untouched. Every step is recorded in a chain of custody.
Examine. We look for the artefacts relevant to the question. That might be file activity, documents, messages, emails, browser history, USB connections, cloud sync records, deleted material, or sign-in and audit logs.
Build a timeline. Most questions come down to who did what, when. A timeline that draws on several independent sources is far more persuasive than any single record.
Report. We set out what we did, what we found, and the limits of what the evidence shows. A good forensic report is honest about uncertainty.
What it can often establish
- Whether files were copied, uploaded, emailed or deleted, and when
- Whether a document has been altered, and sometimes when
- Which accounts accessed a system, and from where
- How an attacker got into an email account or network
- What was on a device, even after some deletion
What it can’t do
- Read minds. The evidence shows activity on an account or device. Linking that to a specific person often relies on other evidence too.
- Always recover everything. Some data is overwritten or was never kept.
- Always name a scammer. Criminals often hide behind overseas services. We’ll tell you where the trail ends.
Questions to ask before engaging an examiner
- Have they given evidence in court, and been cross-examined?
- How do they preserve evidence and document chain of custody?
- Will their report explain method and limitations, not just conclusions?
- Can they work under your instruction so privilege is protected?
For solicitors and accountants
If a client comes to you with a digital problem, the most valuable advice you can give in the first hour is: stop using the device, don’t delete anything, and don’t let IT reimage it. Then call us. We regularly work under instruction from legal teams, and alongside accounting firms in fraud and forensic matters.
See our litigation support page, or our information for referrers.