Jump to Device Forensics Evidence Collection Password Recovery Analysis & Review Expert Reports
01 — Device Forensics

Mobile & Computer Examination

Device examination underpins the majority of digital forensic instructions. CTM Consulting carries out full forensic acquisition and analysis using the same tools employed by law enforcement.

Computer Forensics

Write-blocked forensic imaging of laptops, desktops, and external storage, followed by thorough artefact analysis. Internet browsing history, Windows registry, prefetch files, USB connection records, user activity timelines, email forensics, and deleted document recovery. All imaging is hash-verified for evidential integrity.

Magnet AXIOM EnCase Autopsy / FTK
02 — Evidence Collection

In-Person & Remote Acquisition

Data can be collected on-site at premises or remotely over a secure connection — whichever is appropriate for the matter. Both methods produce the same quality of forensic output with a complete chain of custody.

Remote Forensic Collection

Forensically sound acquisition of data from computers, servers, and cloud accounts over an encrypted connection — no site visit required. A lightweight forensic agent is deployed to the target system by an authorised person. The collection is targeted, auditable, and produces hash-verified output of identical evidential quality to an in-person acquisition.

Devices are at multiple sites or remote locations
Urgent preservation is needed to prevent data loss
Cloud accounts or email systems need to be collected
Disruption to the organisation must be minimised
No Site Visit Required M365 / Google Workspace
Both methods produce hash-verified, court-defensible output with a complete chain of custody record. The choice depends on the circumstances of the instruction — not on evidential quality.
CTM Consulting — Collection Standards

How the Process Works

STEP 01

Scope & Plan

Devices, date ranges, and data targets confirmed. Legal basis agreed and collection plan documented before any work begins.

STEP 02

Agent Deploy

Forensic agent launched on the target system by an authorised person on-site. No technical expertise required to run it.

STEP 03

Secure Acquisition

Data acquired over an encrypted connection. All activity is timestamped and logged throughout in the audit trail.

STEP 04

Verify & Report

Hash verification on completion. Chain of custody document and acquisition report provided before examination begins.

Lawful Instructions Only. All password recovery and decryption work is carried out pursuant to a formal legal instruction with confirmed lawful authority. CTM Consulting does not accept instructions without a proper legal basis.

03 — Password Recovery

Forensic Password Recovery & Decryption

Encryption is encountered routinely in digital forensic casework — on devices, files, archives, and cloud accounts. Where lawful authority exists, CTM Consulting can attempt recovery using specialist hardware and software.

Password-protected documents, encrypted disk volumes, and locked devices can prevent legal teams from accessing material that may be critical to their case. CTM Consulting provides forensic password recovery using targeted and brute-force techniques, applied lawfully and proportionately.

Where full recovery is not possible, a report can confirm the encryption type and the steps taken — which may itself be of evidential value in assessing what was being concealed.

The existence of encryption, or the deliberate destruction of a password, can itself be relevant and admissible evidence in criminal and civil proceedings.
CTM Consulting — Forensic Advisory

Office & Document Files

Password recovery from Word, Excel, PowerPoint, and PDF. Success rates are high for older encryption standards and predictable passwords.

Word / ExcelPDFPowerPoint

Archive & Container Files

Recovery of passwords on compressed archives — commonly used to conceal collections of files in a single protected container.

ZIP / RAR7-ZipTAR

Full Disk Encryption

Examination of devices protected by whole disk encryption. Recovery prospects depend on encryption type and available key material from the investigation.

BitLockerVeraCryptFileVaultLUKS

Mobile Device Access

Forensic bypass and recovery techniques for PIN, pattern, and biometric-protected handsets. Feasibility is assessed per device model and OS version.

AndroidiOSScreen Lock

Encrypted Messaging Apps

Access to local databases of encrypted messaging apps where the device is in forensic possession, including protected app containers.

SignalTelegramWhatsApp

Cloud & Account Access

Where lawful authority exists, CTM Consulting can assist with technical access to and preservation of cloud-stored data and online accounts.

GoogleiCloudOneDrive

Three Approaches, Applied in Order

METHOD 01

Dictionary & Rule-Based

Large wordlists combined with case, substitution, and pattern rules. Effective against passwords based on recognisable words, names, or predictable structures.

METHOD 02

Targeted Intelligence

Case-specific intelligence — known names, dates, or phrases from the investigation — incorporated to significantly narrow the search space.

METHOD 03

GPU-Accelerated Brute Force

Specialist GPU hardware testing combinations at scale. Effective against shorter passwords and weaker encryption implementations, applied proportionately.

04 — Analysis & Review

Specialist Forensic Analysis Services

Beyond device examination and collection, CTM Consulting provides a range of analytical services that sit at the core of most defence and civil instructions.

Deleted Data Recovery

Advanced file carving from unallocated disk space, slack space, and volume shadow copies. Identifies material that has been deliberately deleted, overwritten, or concealed.

Timeline Reconstruction

Correlating device timestamps, application logs, communication records, and system events to produce a precise, defensible chronology for use in proceedings.

Evidence Review & Critique

Systematic independent review of prosecution digital evidence — assessing methodology, completeness, chain of custody, and the validity of conclusions drawn by the opposing expert.

Corporate Investigations

Data exfiltration, IP theft, and insider threat. Targeted acquisition and analysis of employee devices and accounts in support of HR, legal, and disciplinary proceedings.

eDiscovery & Litigation Support

End-to-end ESI collection, processing, de-duplication, and review for civil litigation, employment, and regulatory matters. Full details →

Early Case Consultation

Preliminary advice before formal instruction — identifying whether digital evidence is likely to assist, what examination might reveal, and what a realistic scope and fee looks like.

05 — Expert Witness

Court-Ready Expert Reports

Every instruction that requires court evidence is supported by a structured expert witness report prepared under Criminal Procedure Rules Part 19 or Civil Procedure Rules Part 35.

"It is the duty of an expert to help the court on matters within their expertise. This duty overrides any obligation to the person from whom the expert has received instructions."
Criminal Procedure Rules 2020, Part 19.2

All reports are written to be understood by non-technical readers — judges, jurors, and opposing counsel — without sacrificing accuracy or rigour. Technical findings are explained clearly, conclusions are properly qualified, and the methodology is fully disclosed.

Court attendance for oral evidence and cross-examination is available as part of any instruction. Pre-hearing conferences with counsel and attendance at joint expert meetings can also be arranged. See the Expert Witness page for full detail.

Forensic Expertise When It Matters

Confidential initial consultations at no obligation. Describe your matter and we will confirm whether digital forensics can assist and provide a clear fee estimate.