Gurpreet S. Thathy
Director
Expert witness
TSCM specialist
Law enforcement
Gurpreet leads our digital forensics practice, covering forensic investigations, Technical Surveillance Countermeasures (TSCM) and expert witness work.
Digital Forensics
Digital Forensics Services
Digital investigations for organisations, legal teams and insurers across London and the UK, led by a former Scotland Yard investigator.
When you need to establish what happened, the first priority is to preserve the evidence. We investigate computers, mobile devices, cloud accounts and other digital sources in matters involving employee misconduct, data theft, fraud and corporate legal disputes.
Every stage is documented, from initial preservation and chain of custody through to clear findings and expert reporting. Initial conversations are confidential and without obligation.
TRUSTED BY UK ORGANISATIONS
Who handles your investigation
Every examination is carried out in house by the people below. We do not outsource forensic work.
Jonathan Krause
Founder and Managing Director
New Scotland Yard
Hi-Tech Crime Unit
Founded Forensic Control 2008
Before founding Forensic Control in 2008, Jonathan was a Hi-Tech Crime Unit investigator with the Metropolitan Police at New Scotland Yard. He has spent close to two decades in cyber security and digital forensics since.
What we investigate
01
Workplace and employee misconduct
When you suspect misconduct, the evidence is usually on a device: a work laptop, a phone, an email account. We preserve that evidence before it can be altered or deleted, then establish what actually happened. You receive findings you can rely on in a disciplinary process or an employment tribunal.
02
Data theft and intellectual property
In employee investigations, activity during the weeks before a resignation is often particularly relevant. We examine USB activity, cloud synchronisation, personal email and file transfers to establish what was taken, when, and where it went. The evidence is preserved in a form your solicitors can act on.
03
Fraud and insolvency support
We support solicitors, insolvency practitioners and internal teams by tracing communications, documents and financial records across devices and accounts, and by recovering material that someone hoped was gone.
04
Deleted data recovery and device analysis
Deleting a file does not always make its contents irrecoverable. We recover deleted files, messages and activity records from computers, servers and mobile phones, and we tell you honestly at the outset whether recovery is likely in your case before you commit to a full investigation.
05
Expert witness reporting
Where a matter is heading to court, we prepare expert reports and, where required, give evidence. Findings are written in plain English so that a judge, a tribunal panel or an opposing expert can follow exactly what was done and why.
06
Independent review of forensic reports
If you hold a forensic report you are not confident in, we review how the evidence was identified, preserved and examined, and whether the conclusions are supported. We then advise, candidly, whether a fresh examination is justified or whether the original work is sound. We run a conflict check before accepting any review instruction.
Where digital forensics ends and eDiscovery begins
Legal disputes rarely stay small. The Electronic Discovery Reference Model (EDRM) describes the stages an electronic disclosure exercise moves through, and the first three, identification, preservation and collection, are forensic disciplines. Get those wrong and everything built on them is open to challenge.
1
Identification
Forensic work
2
Preservation
Forensic work
3
Collection
Forensic work
Our forensic work covers those early stages.
4
Processing
eDiscovery
5
Review
eDiscovery
6
Analysis
eDiscovery
7
Production
eDiscovery
When a matter moves into processing, review and production, it transfers into our eDiscovery service without changing hands. The same people who preserved your data defensibly carry it forward, which is precisely what the courts expect and what opposing counsel will test.
How an investigation runs
1
Scope
A confidential conversation to understand the situation, agree the questions the investigation must answer, and give you a realistic view of cost and timescale before anything begins.
2
Preserve
We begin preservation as soon as is practically possible, because evidence degrades with use. We take forensic images of the devices and accounts involved. Wherever possible, examination is carried out on forensic copies. Any necessary interaction with an original device is minimised and documented. Every item is logged in a chain of custody from the moment we receive it.
3
Analyse
Examination of the preserved data against the agreed questions: what happened, when, by whom, and what it means.
4
Report
Findings in plain English, with the technical detail behind them documented and repeatable.
All of our work follows the Association of Chief Police Officers (ACPO) principles for digital evidence, the standard UK courts expect.
Frequently asked questions
How long does a digital forensics investigation take?
Can you recover deleted files and messages from a phone or computer?
How is digital forensics used in workplace investigations?
Do you offer digital forensics on a retainer?
How do I choose a digital forensics provider for eDiscovery readiness?
How much does a digital forensics investigation cost?
Can you review a forensic investigation carried out by someone else?
Speak to us in confidence
We carry out investigations for organisations across the UK. Initial conversations are confidential and without obligation, and we begin work as soon as is practically possible.
