digital forensics
The Fidem lab performs forensic acquisitions and digital forensic examinations for law firms, companies and individuals, in Italy and abroad. Acquisition follows the methods introduced into Italian law by Law 48/2008, which ratified the Budapest Convention on Cybercrime, requiring the integrity of the data to be preserved and its repeatability guaranteed: that is the condition for digital evidence to stand up in court.
What is a digital forensic examination?
A digital forensic examination is the technical investigation through which digital data is acquired, analyzed and documented in a verifiable way, so that it can be used as evidence in civil or criminal proceedings. It is not file recovery, nor the handling of an attack: it is the reconstruction of a fact, with a report that another expert must be able to retrace and reach the same result.
In short
- What we produce: a forensic copy with verification hashes, chain of custody, a reasoned technical report.
- For whom: law firms (as party-appointed experts), companies in litigation or with internal suspicions, individuals.
- Typical cases: disloyal employees and data theft, unfair competition, disputes over email and messaging, unauthorized access, examination of devices and cloud accounts.
- Legal reference: Italian Law 48/2008 (Budapest Convention) for acquisition methods.
- Where: Italy and abroad, with our lab in Verona.
What is NOT included
The examination does not include restoring systems or defending during an ongoing attack, which are different activities assessed separately. We do not carry out activities reserved for licensed private investigators, nor do we access devices or accounts without the legal right to do so.
What does forensic analysis mean?
Forensic analysis means examining a device or digital data with a documented, repeatable method, so that the result can be brought before a judge. The difference from an ordinary technical analysis lies not in the tools but in the constraint: every operation must be recorded, the original must not be altered, and another expert must be able to repeat the same path and obtain the same result.
The terms forensic analysis, computer forensics and digital forensics are used as synonyms. They refer to the same discipline.
What does a forensic analyst do?
They acquire the forensic copy of the media, verify its integrity with a hash, analyze it and write a report that sets out the procedure as well as the conclusions. It is not data recovery: the goal is not to make files accessible again, it is to reconstruct what happened and be able to prove it.
In Italian practice the role almost always works as a party-appointed technical expert on behalf of a law firm, or as a court-appointed expert when the appointment comes from the judge; the distinction is explained further down this page.
Looking for “computer investigations”? You probably need a forensic examination
Those who have suffered data theft or unauthorized access almost never know the technical name of what they need: they search for “computer investigations”, “digital investigations” or “IT examinations”. In most cases the right service is a digital forensic examination, and that is what we do.
Translated into the concrete cases we receive:
- “An employee took the files before resigning”: technical examination of the PC, accounts and USB media: what was copied, when and where to. It is the most frequent case.
- “Someone got into the mailbox”: analysis of logins, automatic forwarding rules and connected devices.
- “I suspect the data ended up with a competitor”: documented reconstruction of the files’ path, usable in court.
- “I have to prove in court what was in that chat”: forensic acquisition of the device with chain of custody, not a screenshot.
- “I have been accused of an access I say I did not make”: technical analysis for the defense, as a party-appointed expert.
In all these cases the work is technical and is carried out on devices and accounts available to whoever hires us, or acquired with a legal title. You do not need an investigator: you need a forensic expert, and you need one before anyone uses the computer and overwrites the traces.
When you really do need a private investigation agency
If the goal is to follow, observe or gather information about a person, such as surveillance, checks on private life or checks on third parties, that is investigative work reserved by law for licensed investigation agencies, and Fidem is not one. In those cases the client hires a licensed agency and we step in, if needed, on the technical part only.
The following remain excluded in any case, and we do not do them for anyone: accessing another person’s phone or account, reading third-party communications, entering systems without the right to do so.
Forensic analysis, digital investigations, technical examinations: are they the same thing?
Yes, in practice they refer to the same technical activity, called in different ways depending on who is speaking: forensic analysis and computer forensics are the technical terms, digital investigations and IT examinations are those used by companies and law firms. The name changes, not the work.
What are forensic investigations on a computer?
They are the examination of what a system has recorded: files, logins, connections, attached media, change history. What surprises those outside the field is that the evidential value often comes not from the files but from the metadata: when a document was copied, from which account, onto which external device.
This is why a device switched on and used after the events loses value every day that passes: the most useful traces are also the most volatile.
our digital forensics service.
Digital forensics is the discipline concerned with the collection, preservation and analysis of digital evidence from electronic devices. We provide forensic copies of PCs and laptops, as well as of external media such as USB sticks and portable hard drives. The service does not cover mobile devices such as smartphones and tablets. Our work includes forensic analysis, which means examining the collected data to identify its content without altering its integrity, following strict protocols. This kind of analysis is fundamental in business and legal settings, where secure handling of digital evidence is essential to guarantee the validity of the information and to protect against potential cyber threats.
We also carry out forensic analysis activities, examining the extracted data to identify key information without compromising its authenticity. We use advanced tools to ensure an accurate assessment of the data, useful for business decisions and for managing digital security. This service is particularly relevant to ensure regulatory compliance and support data protection.
We also offer data recovery from damaged media. Using advanced techniques, we can recover information from devices that have suffered physical damage or malfunctions, such as hard drives, SSDs and USB sticks, to restore vital data after hardware failures or accidental damage.
How much does a digital forensic examination cost?
The cost of a forensic examination cannot be expressed as a list price: it depends on how many devices have to be acquired, how much material has to be analyzed and whether the report has to withstand challenge in court. A forensic copy of a single phone with a short report and an analysis of several workstations with a timeline reconstruction of access are two jobs of different orders of magnitude.
The variables that really move the quote:
- Number and type of devices: a PC, an encrypted phone and a server require different tools and times.
- Volume of data: analysis grows with the volume, not with the number of devices.
- Repeatability: if the examination cannot be repeated, the guaranteed procedure with notice to the parties is needed: more safeguards, more time.
- Purpose of the report: an internal check and an examination intended for the judge have different documentation standards.
- Urgency: volatile traces have to be preserved immediately; acting late costs more and sometimes nothing can be recovered.
For a reliable quote we need three pieces of information: how many devices and which ones, what you want to prove, and whether the material will end up before a judge. Describe the case to us and you will receive scope, timing and cost.
How long does it take?
The forensic acquisition of a device is usually done within a day; analysis and writing the report take from a few days to a few weeks depending on the volume of data. The long part is not copying: it is correlating, verifying and writing so that another expert can retrace every step and reach the same result.
When there is a court deadline, the schedule is built backwards from that date. If the material risks being altered or deleted, acquisition comes before everything else: preserve first, analyze later.
Court expert, court-appointed consultant, party-appointed consultant: what is the difference
They are different procedural roles, not synonyms, and asking for the wrong one wastes time:
- Court expert examination: the technical examination ordered by the judge, entrusted to an expert who answers to the judge.
- Court-appointed technical consultant: the expert appointed by the judge in civil proceedings, with the same auxiliary role.
- Party-appointed technical consultant: the expert who assists one party, reviewing the work of the court’s expert, raising observations and producing their own report. It is the role in which Fidem most often acts, on behalf of a law firm.
There is also the non-repeatable technical examination: when the operation irreversibly alters the source of evidence, which is typical of many digital acquisitions, the procedure requires notice to the parties, who can appoint their own consultants and attend. Skipping that step is the quickest way to make technically correct work unusable.
Does a party-appointed expert report have value in court?
Yes, but not like an examination ordered by the judge: a party’s report is an element the judge assesses freely, not an established truth. Its weight depends on two things: how verifiable the method is, and how well documented the chain of custody is.
This is why acquisition matters more than analysis. A brilliant report built on a badly collected copy can be attacked in one line; an acquisition made according to the methods introduced by Italian Law 48/2008, with verification hashes and a traced chain of custody, holds up even when the conclusion is uncomfortable.
Who can carry out a digital forensic examination?
In Italy there is no official register of IT experts: competence is shown through method, certifications and previous work, not through registration. Courts keep a register of technical consultants, but registration is not required to act as a party-appointed consultant.
What the judge and the opposing party look at is different: whether the acquisition is repeatable, whether the tools are recognized, whether the report sets out the procedure rather than conclusions alone. An examination that cannot be verified is not an examination: it is an opinion.
Where we carry out examinations
Requests reach us from across Italy and abroad, and most forensic work does not require our physical presence: media are acquired in the lab or with an agreed procedure, and the report travels. We work with law firms and companies throughout Italy and, on assignment, in other countries, where acquisition is organized on site and the analysis continues in our lab. When the examination cannot be repeated and the parties must be present, we travel.
Professional Digital Forensics
Fidem’s digital forensics lab acquires, analyzes and documents digital evidence with repeatable, verifiable methods, respecting the chain of custody. The result is material that withstands challenge: not a generic technical report, but a document usable in court, in disciplinary proceedings or for insurance purposes.
We work for law firms, companies, public administrations and individuals, in Italy and abroad.
Need a Digital Forensic Examination?
We work on behalf of law firms, companies and individuals: certified acquisition of devices, analysis and an expert report usable in court, taking on the role of party-appointed technical consultant.
One precaution before anything else: do not use, and do not let anyone use, the devices that contain the evidence, because every access alters metadata and weakens the examination.
Describe your question to us: we reply with a feasibility assessment and a quote. To talk directly with the lab: +39 045 983044. We work in Italy and abroad.
Forensic Acquisition
Acquisition is the phase where the case is won or lost. A copy made without the proper precautions alters the metadata, and from that moment the data can be challenged forever.
We work with hardware write blockers, hash calculation and verification before and after the copy, acquisition records and seals. We acquire disks, storage media, smartphones, running systems (live acquisition when shutting down would destroy evidence), mailboxes and cloud accounts.
Every step is traced: who touched what, when, with which tool and with what outcome.
Forensic Analysis of Devices
Forensic analysis reconstructs what happened on the device: recovery of deleted files, examination of system logs, browsing and search history, program execution artifacts, traces of connected devices, messaging and communication history.
On mobile devices the scope includes chats, geolocation, backups, installed applications and residual data. In the cloud it includes logins, shares, synchronizations and deletions.
The reconstruction is always brought back to a timeline: without a coherent chronology, the individual findings say little.
Expert Reports
We write digital forensic reports and technical reports structured for use in proceedings: question, methodology adopted, tools used with their versions, findings, analysis, conclusions and reservations.
We take on the role of party-appointed technical consultant in support of counsel, and act as auxiliaries in technical examinations. A party’s expert report serves two purposes: supporting a position with verifiable elements, and enabling the opposing party or the judge to repeat the checks.
Forensics After an Incident: How Evidence Is Preserved
When a company discovers unauthorized access, the question that matters legally is always the same: what can be proven. Where they got in, what they touched, which data left and when, and with which elements this can be proven.
The most frequent mistake is restoring systems before acquiring them: you get back up and running and then find you have nothing left to produce. Traces have to be preserved first, with a forensic copy and chain of custody, otherwise the reconstruction remains a story without proof.
Our role is that of the forensic expert, not of emergency response: we acquire the evidence, analyze the logs, reconstruct the scope of what was actually reached and produce a technical report usable in court and in support of the obligations towards the data protection authority and the people involved.
Digital Forensic Expert: When You Need One
You need a digital forensic expert whenever a relevant fact happened on a computer system and has to be proven to someone who was not there.
The recurring situations: unfair competition and data theft by a departing employee; dismissals and employment disputes involving the use of company tools; cyber fraud and scams with diverted bank transfers; online defamation and threats; disputes over the authorship of software or digital content; checks on disputed email.
In all these cases the difference between useful evidence and unusable evidence is decided in the first steps, often before a lawyer is involved.
Disloyal Employees and Theft of Company Data: the Forensic Examination
It is the most frequent case that reaches our lab: an employee or former employee takes away the customer list, quotes, projects, know-how, and you find them at a competitor or in their new business.
The recurring signs are always the same: massive copying of files to USB sticks or external disks in the last days of work, emails sent to personal mailboxes, access to the company cloud at unusual hours or after the end of employment, bulk deletions to cover tracks.
The digital forensic examination documents these steps starting from the forensic copy of company devices, respecting the chain of custody: the result is an examination usable in civil and criminal proceedings and in employment disputes, for unfair competition, breach of trade secrets, disciplinary action or dismissal.
A warning that makes the difference: checks on devices used by workers touch on privacy and employment law. This is why we work together with your law firm from the definition of the question: the investigation is born usable, instead of becoming a problem itself.
Describe the case to us: we assess the feasibility and scope of the examination before any activity.
Technical Examinations of Company Devices and Accounts
Digital investigations start from the data the organization already holds: access logs, email, assigned devices, traces on shared systems. This material has evidential value only if acquired correctly and before it is overwritten.
Technical examinations can be repeatable or non-repeatable. In the second case, typical of the analysis of a device that will be altered by the examination, the procedural framework is strict and has to be managed from the start together with counsel, because a defect at this stage cannot be cured later.
When the analysis has to extend to open sources, such as profiles, registrations and published content, the work continues on the level of OSINT and web reputation.
Digital Investigations on Cloud Services and Accounts
A growing share of digital investigations no longer concerns a physical disk but an account: cloud email, shared storage, SaaS business applications, company messaging systems.
The technique changes but not the principle: the provider’s logs are needed, the export must be carried out in a documented way, and the log retention window is often short. In most cloud services logins are kept for a limited period: whoever acts three months later finds the log already rotated.
If you suspect a compromise or data theft, a preservation request to the provider is the first action to take, even before the analysis.
Where We Work
The lab is based in the province of Verona, Italy, and works across Italy and abroad. Acquisition takes place on site where the evidence requires it, such as seized devices, servers that cannot be moved or examinations in the presence of the parties, while analysis and reporting continue in the lab.
We regularly handle assignments in Italy’s main cities and, on request, in other countries, in cooperation with local law firms.
For immediate advice in the event of an incident, contact us. The team is available for forensic emergencies.
Related topics
Services that complement forensic work: OSINT and digital reconnaissance · log analysis · web reputation and brand protection
Services related to forensic work: company cybersecurity · penetration testing · the Fidem lab
Related technical analysis: Wi-Fi network security testing · log analysis
Definitions: digital forensic examination · chain of custody in the cybersecurity glossary.