Digital forensics · Kraków and across Poland
Data analysis from phones, computers and storage media
Messages, files, multimedia and metadata can help clarify the course of events. I establish what information can be obtained from a particular device, storage medium or data copy and how it relates to the questions in the case.
Examination scope
Digital forensics
Digital forensics covers acquiring, analysing and interpreting data from devices and storage media. An examination may concern message contents, files, activity history or the chronology of events. I select the scope to suit the available material and the questions requiring clarification.
I prepare opinions on digital material for courts, prosecutors and the Police, as well as analyses for individual clients. My office is in Kraków; I accept cases from Małopolska and across Poland. Before equipment or data is handed over, we agree on the scope and conditions of the examination.
Phones and mobile data
Analysis of available messages, files, multimedia and other data related to the questions in the case. The ability to obtain information depends on the device model, operating system, security measures and condition.
Computers and storage media
Analysis of material held on a computer, storage medium or supplied data copy. The scope may include files, their metadata and information about available activity history.
Event timeline
Organising identified information and comparing it against the questions. Dates, metadata and the material’s content require interpretation with regard to the source and data limitations.
Preservation and examination documentation
Depending on the material, work may include making a copy, calculating checksums, describing tools and compiling findings. Documentation distinguishes source data from its interpretation.
Example questions for analysis
- Which messages, files or multimedia are available in the submitted material?
- What information about time and activity history can be read from the data?
- Does the available material allow the sequence of events relevant to the case to be reconstructed?
- Which limitations of the device or copy affect the possible examination scope?
Preparation
What to describe
in the initial enquiry?
Start by describing the device, its condition and the information sought. If the enquiry concerns proceedings, provide the authority, case reference, questions for the opinion and any relevant deadline. For a private individual, a description of the problem and available material is sufficient. We will agree on how to deliver equipment or data before you transfer it.
- Type, brand and model of the phone, computer or storage medium.
- A description of the device’s condition and information about available security measures.
- Information on whether you have a device, data copy, files or only documentation.
- The type of data sought, relevant time period and questions for analysis.
- A deadline relevant to the case and contact details for a reply.
How we work together
Four stages of work.
Device description and questions
You specify the type of device or copy, the information sought and the period the analysis concerns. We establish the questions and availability of material.
Scope and transfer arrangements
I assess whether an examination can be performed. We agree on the scope of work, cost, timeframe and delivery of the device, storage medium or data copy.
Acquisition and analysis
I select the actions to suit the particular material, its condition and the agreed questions.
Findings and limitations
In my report, I separate source data from its interpretation and identify circumstances affecting the conclusions.
Report
What do you receive?
- Findings on the questions within the examination's scope.
- Compilation of relevant data and its interpretation in the context of the case.
- Description of the work performed, tools and limitations of the analysis.
The possibilities depend on the material
- Not all deleted data can be recovered. Relevant factors include the device model, operating system, encryption, storage medium condition and changes after deletion.
- A description of the software’s capabilities does not mean every device can be unlocked or all information obtained.
- Analysis of a copy or documentation may differ in scope from examination of the device. Differences should be assessed in relation to the questions in the case.
Practical information
Questions and answers.
Can all deleted data be recovered?
There is no such guarantee. The possibilities depend on factors including the device model, operating system, encryption, storage medium condition and changes after deletion. Limitations are taken into account in the analysis results.
Is the device needed, or is a data copy sufficient?
This depends on the questions and type of material. In your enquiry, state whether you have a device, a data copy, selected files or documentation alone. We will use this to establish what is needed for the examination.
Which data can be analysed?
The scope may include messages, files, multimedia, metadata, activity history and an event timeline. The availability of individual items of information depends on the specific device or material provided.
Can an analysis be commissioned from outside Kraków?
Yes, I accept cases from across Poland. I agree individually on how to hand over a device, storage medium or files before delivery.
What determines the price and turnaround time of an analysis?
The questions, type and volume of data, device condition, security measures and required work. I determine the cost and timeframe after an initial review of the case.
What should I prepare if I only have a report from an earlier phone examination?
Provide the report’s format and name, the software or organisation that produced it, and your question about a specific message, file or period. State whether you also have a data export, attachments or access to the device. A printout or PDF alone may not contain the data needed to check how the material was acquired and whether it is complete; I determine the possible scope of analysis after reviewing the available sources.
Methods and documentation
Tools selected to suit the material
MOBILedit Forensic ULTRA supports the acquisition, analysis and reporting of mobile device data. The tool's functions are selected to suit the material and questions, and results are assessed in light of the examination's limitations.
View equipment, training and documentation
Related material
How should you prepare a phone for an agreed examination?
How to describe a phone, agree on the scope of examination and prepare to hand over the device. Why switching off, unlocking or updating requires prior agreement.
Read the guide →Preparing for an expert examinationRecovering deleted messages: possibilities and limitations
What determines whether deleted messages can be recovered from a phone? Backups, encryption, data remnants and the limits of analytical conclusions.
Read the guide →Let's discuss your case
Describe the device and data relevant to the case
Provide the device model and condition, the type of data available and your questions. In response, we will establish what is needed to assess whether examination is possible.