Investigation in digital environments
Investigation of fraud, leaks and misconduct in corporate systems and devices.
- DURING THE INVESTIGATION
- 01THE PROBLEMA suspicion of internal fraud, information leakage or intellectual property infringement that needs facts before any action.
- 02WHO IT IS FORCompliance, legal, HR and executive teams.
- 03INTENDED OUTCOMEA report that separates fact, hypothesis and conclusion, with the evidence preserved for a possible forensic examination.
What changes for decision makers.
- FOR THEComplianceInvestigate with method“A report or a suspicion of fraud needs facts, not impressions.”An investigation proportionate to its purpose, with every stage documented and the chain of custody preserved.
- FOR THE DEPARTMENTLegalFacts before action“A dismissal, a lawsuit or a settlement depends on what actually happened in the systems.”A report that separates fact, hypothesis and conclusion, with the evidence preserved if the case goes to court.
- FOR THEHRConduct without exposure“A poorly run conduct investigation exposes people and the organization.”Collection limited to the authorized scope, with findings shared only with decision-makers.
- FOR THEExecutive teamLeaks and intellectual property“Strategic information got out and nobody knows how.”The path of the information reconstructed across corporate email, cloud, devices and messaging.
Investigation with a defined scope.
We start from the purpose and what legal counsel authorized, not from a broad search through people’s data.
Scroll sideways to see the whole diagram
- Corporate email
- Mailboxes in scope
- Cloud
- Files and shares
- Workstations and phones
- Company-owned
- Messaging
- Used for work, when authorized
- Logs
- Access and audit trails
Visible progress, protected investigation.
Depending on the case, the client follows the stages (scope and legal basis, collection and preservation, analysis, report), the dates and what depends on them in the forense.io portal. Findings and people in scope never appear in the portal.
Five documented stages.
Each stage is recorded and can be verified by another specialist.
- STAGE 01DefineWhat is the purpose and who is in scope?
- STAGE 02PreserveIs the copy identical to the source?
- STAGE 03SearchWhere did the information go?
- STAGE 04CorrelateDo the sources tell the same story?
- STAGE 05ReportWhat is fact and what is hypothesis?
Method, not verdict.
The report describes what the records show. Decisions about people and measures belong to the organization.
- SCOPEProportionate to the purposePersonal data outside the scope is not examined.
- INTEGRITYHash and chain of custodyFrom collection to report.
- DISCRETIONRestricted accessOnly decision-makers see the findings.
- BOUNDARYNo legal adviceTechnical work alongside legal counsel.
Why forense.io
- 01Scope and legal basis before collectionPurpose, systems and people in scope are defined and validated with legal counsel before any access.
- 02Corporate environmentEmail, cloud, workstations, company phones, access logs and messaging used for work.
- 03ProportionalityCollection and examination limited to what the purpose requires; personal data outside the scope is not examined.
- 04Ready to become forensicsPreservation with integrity verification and chain of custody: if the case goes to court, the evidence is already protected.
- 05Independent technical reviewEvery report goes through an independent technical review before delivery.
Stages of the work.
- 01Purpose, scope and legal basis validated with legal counsel
- 02Recorded collection and preservation
- 03Analysis and correlation of sources
- 04Investigation report
What is included.
How we work with what you already have.
We work with the client’s legal and compliance teams and do not replace legal advice. The purpose and the legal basis guide every collection.
- 01Your legal teamDefines the purpose and validates the legal basis; forense.io handles the technical work.purpose and measures
- 02Compliance and HRReceive reports and carry out internal measures.internal measures
- 03Your ITProvides access to the systems in scope without changing what must be preserved.system access
| Activity | forense.io | Your team | Third parties |
|---|---|---|---|
| Purpose and legal basis | supports | executes | — |
| Collection and preservation | executes | supports | supports |
| Analysis and timeline | executes | — | — |
| Investigation report | executes | — | — |
| Measures and decisions | supports | executes | — |
Two models, as set in the contract.
- MODEL 01PreservationCollection and preservation of the sources in scope, to protect the evidence before it is lost.
- MODEL 02Preservation + InvestigationThe full flow, with analysis, timeline and investigation report. A change of model is formalized by amendment.
What people usually ask us.
Can an organization examine an employee’s corporate email?
It depends on the purpose, internal policies and legal basis. The scope is validated with legal counsel before collection.
Do you examine someone’s personal phone?
Only with the owner’s authorization or a court order. Company devices and accounts follow the organization’s policies.
Does the report name who is guilty?
No. It describes what the records show and states its limitations; decisions about people and measures belong to the organization.
What if the case goes to court?
Preservation already follows the forensic method, with chain of custody; the investigation can be the basis for a forensic report or opinion.
Do you replace the lawyer?
No. forense.io works on the technical side; purpose, legal theory and measures belong to legal counsel.
Want to know if Investigation in digital environments fits your situation?
- conversation
- assessment
- proposal