Security services · Investigation

Digital forensics you can take to court.

Who did it, how, when, and what did they take? We collect and analyse digital evidence from computers, phones, email and cloud services in a way that holds up with courts, regulators and insurers.

Get a fixed-price quote
Chain of custody from the first minuteHash-verified evidence copiesBuilt to support a Section 63 BSA certificate
investigation · sample● demo
  1. FLAGGED USB drive used the night before resignation
  2. FOUND Mail forwarded to a personal address for 6 weeks
  3. FLAGGED Logs cleared at 02:40
  4. PASSED Evidence hashes verified
  5. FIXED Timeline handed to legal counsel
In plain words

Digital forensics is the careful, documented collection and analysis of electronic evidence: laptops, phones, servers, email, cloud accounts and logs. We preserve the evidence first, make verified copies, then reconstruct what happened, when and who was involved. Every step is recorded in a chain of custody, so the findings can support legal proceedings, disciplinary action, regulator questions or an insurance claim.

First findings
From 48 hours
Standard
ISO/IEC 27037
Evidence
Hash-verified, chain of custody
Pricing
Per case
Why method matters

Evidence is only as strong as its chain of custody.

If nobody can show where a file came from and that it was not changed, a court or regulator may give it little weight. Every item we handle carries its own record, from collection to report.

Chain of custody in six linked steps: identify, preserve, acquire, verify, analyse and report. The verified copy has the same SHA-256 hash as the original drive, proving nothing was changed. CHAIN OF CUSTODY 01IDENTIFYWhat to collect,and where it is02PRESERVELegal hold; stoplogs rolling over03ACQUIREWrite-blocked copyof each device04VERIFYCopy’s hash matchesthe original05ANALYSEWork on the copy,never the original06REPORTTimeline, findingsand certificate ORIGINAL DRIVE SHA-256 9f2c41b7 … 0d3ea71e = VERIFIED COPY SHA-256 9f2c41b7 … 0d3ea71e ✓ Every hand-over is logged: who, when and why. Evidence is sealed and stored under access control.
A hash is a digital fingerprint. If even one bit of the copy differed from the original, the two values would not match. Hash values shown are a sample.
What we examine

Wherever the evidence lives.

  • Laptops and desktops

    Windows, macOS and Linux: disk and memory, including deleted files where recoverable.

  • Phones and tablets

    Android and iPhone, where you have the legal right to examine them.

  • Email

    Microsoft 365, Google Workspace and mail servers: messages, rules, sign-ins.

  • Cloud accounts

    AWS, Azure and Google Cloud audit logs: who did what, and when.

  • Servers and network logs

    Firewalls, VPN, proxies and servers, to trace movement and data leaving.

  • Chat and file sharing

    Teams, Slack, OneDrive, Google Drive and exported chat histories.

  • USB and removable media

    What was copied, to which device, and when.

  • AI tools

    Chat histories with AI assistants and the action logs of AI agents.

  • Fraud and payment trails

    Invoices, approvals and messages behind a suspicious payment.

A typical case

The employee who left with the client list.

  1. The triggerA senior manager resigns to join a competitor

    Weeks later, clients start getting calls from the competitor with your pricing.

  2. PreserveThe laptop and mailbox are preserved

    Before IT reissues the laptop, it is set aside and imaged, and the mailbox is put on legal hold.

  3. FindingA USB copy the night before the resignation

    The client list and pricing sheets were copied to a personal drive at 23:41.

  4. FindingA hidden forwarding rule

    For six weeks, contracts had been forwarded to a personal email address.

  5. OutcomeA clear, verified timeline

    Your lawyers get a report and hash-verified evidence, ready for the next step.

Preserve first

The most common way evidence is lost is well-meaning IT staff wiping or reissuing a device. If an investigation is possible, set the device aside as it is, stop automatic log deletion, and call us before anyone looks around.

How it works

Five steps, each one recorded.

  1. Day 0

    Preservation

    Legal hold, isolate devices, stop logs from rolling over, and start the custody record.

  2. Day 1

    Acquisition

    Write-blocked images of disks, phones and cloud accounts, each verified by its hash.

  3. From day 2

    Analysis

    Timelines, deleted data, user activity and data movement, worked on copies only.

  4. From 48 hours

    Reporting

    Early findings first, then a full report written for lawyers and decision-makers.

  5. On request

    Testimony

    The examiner who did the work explains the findings to a court or tribunal.

What you get

Evidence and answers you can rely on.

HANULSECDigital forensics report CLIENTSample · data theft by a departing employee SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High2Medium3Low1 EVIDENCE · 4 DEVICES · 2 CLOUD ACCOUNTS HASHES VERIFIED Sample layout, not client data
  • 01
    Forensic report

    Findings, method and limits, in language a judge or board can follow.

  • 02
    Timeline of events

    Every relevant action, in order, with its source.

  • 03
    Preserved evidence images

    Hash-verified copies, stored securely for as long as you need them.

  • 04
    Chain-of-custody records

    Who handled each item, when and why.

  • 05
    Expert testimony

    Available on request.

Who it is for

When you need to know exactly what happened.

  • HR and legal teams investigating misconduct or data theft
  • Companies after a cyber incident who need to know what was taken
  • Law firms that need evidence collected and handled properly
  • Insurers and loss adjusters examining a claim
  • Boards that need an independent investigation

Indian courts and electronic evidence

Since 1 July 2024, electronic records in Indian courts fall under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Indian Evidence Act. It asks for a certificate signed by the person in charge of the device and by an expert.

We collect and document evidence so it can support that certificate. Your lawyers decide how it is used.

Standards

Handled to recognised standards.

ISO/IEC 27037Evidence handling
NIST SP 800-61Incident handling
MITRE ATT&CKAdversary behaviour
DPDP Act 2023With the DPDP Rules 2025

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is digital forensics?
Digital forensics is the scientific collection and analysis of electronic evidence, such as computers, phones, email and cloud logs, done in a way that preserves the evidence and documents every step, so the findings can be relied on by courts, regulators and insurers.
Q02Can deleted files be recovered?
Often, but not always. It depends on the device, encryption, how long ago the files were deleted and whether the device has been used since. The sooner a device is preserved, the better the chances.
Q03Will the evidence hold up in an Indian court?
We follow ISO/IEC 27037 and keep a full chain of custody with hash-verified copies, so the evidence can support the certificate required under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023. Admissibility is always for the court to decide, guided by your lawyers.
Q04Can you examine an employee’s phone?
Only where there is a legal right to: a company-owned device, the owner’s consent or a court order. We agree this with your lawyers before touching any device.
Q05How quickly can you start?
Preservation advice can start on the first call. First findings are often ready from 48 hours after we receive the evidence; full investigations take longer, depending on the devices and questions involved.
Q06Do you provide expert witness testimony?
Yes, on request. The examiner who did the work can explain the method and findings to a court or tribunal.
Q07How is a forensic investigation priced?
Per case, after a short call about the devices, accounts and questions involved.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings