Digital forensics and eDiscovery
Evidence from phones, laptops, e-mail and cloud accounts, collected so that a court will accept it and reviewed so that you find what matters quickly.
Defensible imaging of phones, laptops, servers, e-mail and cloud accounts in BDI's in-house forensic lab, with AI-assisted review that surfaces red-flag patterns.
Most evidence of misconduct now sits on devices and in messages: e-mail, chat, call logs, shared drives and cloud accounts. Collected carelessly, it can be altered or challenged. Collected properly, it often settles the question.
BDI images devices and accounts in its own forensic lab or on site, with a documented chain of custody from the first moment. Deleted chats, calls and files are recovered where the device allows. Keyword, concept and AI-assisted review then narrows large volumes of data to the material that answers your questions.
Findings are presented as timelines and link charts of people, firms and money, so a board can see what happened without reading every message. Electronic evidence comes with the certificate a court requires.
The evidence sits on devices, e-mail or chat, and it has to be collected in a way a court will accept.
Signs we see most often
- 01An employee is leaving or has left, and you suspect data or customers went too.
- 02An allegation turns on what was said in e-mail, chat or calls.
- 03A key person's device must be preserved before it is wiped or returned.
- 04Litigation or arbitration requires review of a large volume of documents.
- 05A regulator or agency has asked for records and you need to know what they contain first.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01IdentifyMap the custodians, devices, accounts and data sources relevant to the questions.
- 02PreserveImage devices and accounts forensically, with hash values and chain-of-custody records.
- 03RecoverRetrieve deleted messages, call logs and files where the device and the law allow.
- 04ReviewApply keyword, concept and AI-assisted review to surface relevant and privileged material.
- 05AnalyseBuild timelines and link charts of people, firms and money.
- 06CertifyReport the findings with the certificate and documentation a court requires.
Findings with a documented chain of custody and a Section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023, for electronic evidence.
- Forensic images with hash verification and chain-of-custody records
- A review set of relevant documents and messages, tagged by issue
- Timelines and link charts of key events and relationships
- A findings report written for non-technical readers
- A Section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023
The law and frameworks this work is aligned to
- Bharatiya Sakshya Adhiniyam, 2023 s.63 on the admissibility of electronic records
- Aligned to ISO/IEC 27037 on identifying, collecting and preserving digital evidence
- ISO/IEC 27042 on the analysis and interpretation of digital evidence
- NIST SP 800-86 guidance on forensic techniques
- DPDP Act, 2023 for proportionate and lawful processing of personal data
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerWhere this service meets BDI's technology.
The platforms below record, monitor or act on the work this service produces.
Questions clients ask before we start.
Can you image a device without the employee knowing?
Company-owned devices and accounts can usually be preserved discreetly under the employer's policies. Personal devices need consent or a legal order. We advise on the lawful route before any collection begins.
Can deleted chat messages be recovered?
Sometimes. It depends on the device, its operating system, encryption and how long ago the data was deleted. After an initial examination we tell you what is realistically recoverable.
What about privacy and privilege?
Collection is limited to what the questions require, personal data is handled under a documented protocol, and potentially privileged material is set aside for counsel before review.