Questions and answers
Answers to common questions about technical, computer forensic and IT examinations: materials, access, opinion format, reviews and examination limitations.
Can a website be examined without server access?
Yes, if the questions raised can be resolved using the public-facing website, archived copies, documents and other available materials. Access may be necessary to analyze the server side, logs, code or database.
Can an examination be conducted using file copies alone?
For some tasks, yes. The opinion must specify precisely that a copy, export or other supplied material was examined and which limitations follow from this.
Should passwords be sent through the website form?
No. Passwords, keys and confidential access should be provided only after agreeing on a secure method and establishing that access is needed for the specific task.
How does a pre-litigation opinion differ from a court-appointed examination?
Their procedural status and commissioning procedures differ. In either case, the technical examination must remain verifiable, clear and limited to the questions raised and materials provided.
Can an existing IT expert report be reviewed?
Yes. Checks cover the examination subject, source materials, methodological approach, completeness of technical checks, reasoning from results to conclusions and whether the answers address the questions raised.
Can you establish exactly who performed an action in a system?
Sometimes logs and other data link an event to an account, device, IP address or session. However, identifying a technical account with a particular person requires a separate body of evidence and is not always possible through technical means alone.
Can you answer whether a contractor breached a contract?
An expert can establish technical properties of the deliverable, the presence or absence of functions and compare them with technical requirements. Legal characterization of a contractual breach is for the court or parties.
What determines the fee?
The number of objects and questions, file and log volume, need for inspection or an on-site visit, access, difficulty of reproducing a defect and required deliverable format.
Can you work with large volumes of logs and SQL data?
Yes, but agree on the format, period, structure and transfer method before examination. Sometimes a representative dataset or one relevant to the question must be defined first.
What should I attach to an initial inquiry?
A brief task description, contract or technical specifications, disputed acceptance certificates or correspondence and a few key technical materials are usually sufficient. The full dataset can be agreed after an initial assessment.
Tell us
about your task.
Describe the situation and attach the materials. After reviewing your request, we will agree on the examination format, questions, timeframe and cost.