Decode Forensics & Investigations

More and more frequently, we are being asked about technology-enabled abuse by legal teams.   To give an example, their client has left a relationship but notices that their ex seems to know things they shouldn't, where they have been, who they have spoken to, what was said! This can be very disturbing for the client involved.  So they suspect they are being monitored, but how do they prove it? We are able to examine devices and often find the following: - location-sharing never switched off. - A forgotten shared cloud account, quietly syncing messages to someone else's login. - A smart doorbell still tied to an ex-partner's account. - Legitimate features, weaponised. It is worth knowing that if this reaches your desk: These devices leave evidence such as access logs, login locations, and linked devices. "They always seem to know" can become a documented, timestamped record of exactly how. If you're acting for someone describing this pattern, we can, in confidence, examine the devices, try and establish how it happened, and produce findings that stand up. #technologyabuse #digitalprivacy #cybersecurity #onlinesafety #dataprotection #techawareness

When we talk about eDiscovery, people tend to focus on the review. But what happens before the review is just as important. Data processing is what makes the review possible in the first place. Raw data in its original state is rarely ready to work with. It needs to be organised, filtered and cleaned before a legal team can meaningfully engage with it. That means applying filters,  date ranges, keywords, specific topics, to isolate what is actually relevant. It means removing duplicate documents so nobody wastes time reviewing the same thing twice. And it means converting data into a format that is structured, navigable and easy to work with under time pressure. Done properly, this stage has a significant impact on everything that follows. The review is faster. The costs are lower. The dataset is cleaner and more reliable. And the conclusions drawn from it are easier to defend. Our approach is to get this right before anything goes near the review platform because the quality of what comes out at the end depends entirely on the quality of what went in at the start. #ediscovery #dataprocessing #litigationsupport #digitalforensics #decodeforensics #legaltech #documentreview

One of the most common assumptions we come across is that instructing a digital forensics team means committing to a full, expensive investigation from day one. It does not have to work that way. Digital forensics can be done in stages. And the best place to start is triage. Early case triage gives legal and investigation teams a structured view of what they are actually dealing with before any major commitments are made. Where the data sits. Which sources are most likely to matter. What needs to be preserved. What can reasonably be set aside. What might need deeper analysis later. It is a starting point, not a final answer. But it is a starting point that gives you something genuinely useful,  a clear picture of the landscape that allows you to move forward strategically rather than reactively. If the cost of digital forensics has ever put you off exploring it earlier in a matter, it is worth knowing that there is another way to begin. #earlycasetriage #ediscovery #litigationsupport #digitalforensics #legaltech #decodeforensics #investigationsupport

People often ask us what tools we use. It is a fair question. The honest answer is that there is no single tool that does everything. Different phases of an investigation require different tools, some for capturing data from devices, others for examining emails, mobile phones, databases or network activity. We use a combination of both, depending on what the matter requires. But here is the thing. The tools are not really the point. The value in a digital forensic investigation does not come from which software is running in the background. It comes from the expertise and judgement of the people interpreting what those tools find. A tool will show you the data. An experienced investigator will tell you what it means, why it matters, and how to present it in a way that holds up. Where findings are particularly significant, we use multiple tools to validate the results. That cross-validation is what makes the evidence harder to challenge. So when clients ask about our tools, our answer is always the same. We use the right ones for the job. But what you are really instructing is the expertise behind them. #digitalforensics #forensictools #litigationsupport #decodeforensics #ediscovery #digitalevidence #expertwitness

Can a WhatsApp message amount to a legally binding agreement? The article discusses a case involving a divorced couple and a £1.5 million north London home. The former husband had sent messages indicating he would sign over his share of the property to his ex-wife. She argued those messages constituted a valid agreement. The court disagreed, stating it found the messages fell well short of the statutory requirements for a disposition of land. A WhatsApp sender name is system-generated, not a deliberate signature. Intention was not clearly enough expressed. The 50% share remained part of the bankruptcy estate. Now, the judgment does not close the door entirely on digital communications carrying legal weight in other contexts. But for anything involving land, trusts or beneficial ownership, the message is clear, informal exchanges are not enough. For those advising clients navigating separation, divorce or estate planning, this decision is a useful reference point. It also raises an interesting evidential question. Where messages like these are disputed, or where the authenticity or completeness of a digital exchange becomes relevant, forensic examination of the underlying data is increasingly how courts get to the truth. We're curious whether others are seeing this type of issue come up in practice. Full article linked in the comments.  #digitalevidence #digitalforensics #propertylaw #familylaw #litigationsupport #decodeforensics  Full case summary can be read here:

A breach rarely comes down to one single failure. More often, it is a chain of small weaknesses that only becomes obvious afterwards. An account that stayed active too long. A supplier connection that was not reviewed. A file share with too many permissions. A device holding more sensitive data than expected. A process that relied on trust rather than control. The best situation is to identify them before they become part of the incident narrative. Our breach prevention service gives leadership, legal, compliance and audit teams a clearer view of where sensitive data sits, who can access it, and where misuse or unauthorised access could realistically occur. #breachprevention #internalaudit #riskmanagement #corporategovernance #datasecurity

The legal question around admissibility is one for the lawyers in the room. But before that question even gets answered, there is a digital forensic one that often gets overlooked. Can you prove the recording is what you say it is? When we examine a recording, we are looking at several things. - Whether it is complete, or whether there are gaps that could suggest editing. - Whether the metadata- the file creation date, the device it was recorded on, the timestamps- is consistent with the account of when and where it was made. - Whether the audio itself shows signs of manipulation or splicing. Those are not abstract concerns. Opposing counsel will ask exactly those questions. If the recording is going to be relied upon as a key exhibit, it needs to withstand that scrutiny before it gets anywhere near a tribunal or courtroom. We can typically turn around a forensic examination of a recording within a matter of days. The alternative is having a key exhibit successfully challenged at hearing because nobody checked it first; will take considerably longer to recover from. The admissibility question and the authenticity question are separate. Both matter. And in our experience, the second one gets asked far too late. #digitalforensics #covertrecordings #employmenttribunal #digitalevidence #litigationsupport #decodeforensics #familylaw

A great result for the Quinn Emanuel team, we were delighted to support this huge win for the firm and its client Peter Waddell / Peter Waddell Holdco. Congratulations!

We had a conversation with a GC recently who asked what we are seeing more of at the moment. Failure to Prevent Fraud keeps coming up. It came into force in September 2025, the SFO has publicly said it wants to be the first to prosecute, and investigations are expected to open this year. What strikes us in these conversations is how often the compliance work has been done, but the evidential trail has not been thought through. Training completed. Policies in place. Controls implemented. All of that may well be true. But when the SFO asks whether those procedures were real and effective, the answer has to come from somewhere. Communications showing awareness of the risk. Records demonstrating training actually happened. Data showing when controls were applied and by whom. Good compliance work and a defensible digital record of that work are not the same thing. The organisations that will be in the strongest position are the ones where both exist. The standard of documentation has become the standard of defence. #failuretopreventfraud #whitecollarcrime #digitalforensics #corporatecompliance #decodeforensics #sfo #fraudprevention

Technology-enabled abuse is appearing with increasing regularity in family law, employment, and civil disputes. - Spyware on devices. - Location tracking without consent. - AI-generated audio designed to sound like someone who did not say it. - Covertly recorded conversations presented as evidence. - Deepfakes submitted in proceedings involving children. A 2026 study found that 45.7% of respondents had experienced at least one form of tech abuse in the previous 12 months, but only 32% correctly understood what the term meant. For lawyers, the practical challenge is evidential. - How do you prove a recording is genuine, or fabricated? - How do you establish that a device was compromised? - How do you demonstrate a pattern of digital control to a tribunal or court? Digital forensic investigation can authenticate recordings, examine devices for spyware or tracking software, and establish what was accessed, when, and by whom. It is an area where the technical evidence often says more than witness testimony can. #digitalforensics #technologyabuse #employmentlaw #familylaw #digitalevidence #decodeforensics #litigationsupport Source: Kaspersky's 2026 study on technology-facilitated abuse