When something serious happens in your digital life, an employee walks out with your client database, a fraudster drains an account, a harasser hides behind anonymous profiles, or you simply need to know the truth about what happened on a device you own, the difference between a hunch and a result is evidence that was collected properly. A screenshot proves almost nothing. A forensically acquired image of a device, with a documented chain of custody and an expert report explaining what it shows, can decide a lawsuit, support a prosecution, or settle a dispute before it ever reaches a courtroom. Spy and Monitor provides professional digital forensics and open-source investigation for individuals, businesses, and legal teams, always within a strict lawful framework. This page explains what digital forensics can and cannot do, how device and cloud examinations work, the truth about deleted data, why chain of custody decides whether evidence survives, the legal boundaries we never cross, and what an engagement looks like from intake to expert report. For a broader primer, see our guide on what digital forensics is and when you need it.
What is digital forensics?
Digital forensics is the structured identification, preservation, analysis, and presentation of electronic evidence, done in a way that keeps the evidence intact and its handling provable. The key word is structured. Anyone can scroll through a phone; a forensic examiner acquires an exact, verified copy of the device, works only on the copy, documents every step, and produces findings that can withstand hostile cross-examination. The method is what turns data into evidence.
Device forensics: phones and computers
Devices are the richest evidence sources in most cases, because they record far more than their owners realize.
What a phone examination can recover
A forensic examination of a smartphone you own or are authorized to examine can surface call logs and contacts, SMS and app messages (WhatsApp, Telegram, Signal databases stored on the device), photos and videos with their embedded location and time metadata, browser and search history, app usage records, connected Wi-Fi networks, and location history. Together these reconstruct timelines: where the device was, what it was used for, and when. Phone examinations are central to harassment cases, theft investigations, and fraud reconstruction. If you suspect your own phone is compromised, an examination can also identify stalkerware and spyware, and our article on common phone hacking methods explains what we look for.
What a computer examination can recover
Laptops and desktops yield documents and their edit histories, email archives, browser activity, USB device connection records (often decisive in data theft cases: they show exactly which external drive was plugged in, when, and frequently what was copied), cloud sync folders, deleted file remnants, and system logs showing logins, file access, and program execution. For businesses investigating an insider, this is usually where the case is made or broken.
Cloud and account forensics
Modern evidence increasingly lives off the device: in email accounts, cloud storage, collaboration platforms, and social media. With proper authorization, account owner consent, or corporate ownership of the account, we examine access logs (who logged in, from where, on what device), mail forwarding rules and OAuth grants that attackers plant to maintain access, file sharing and download histories in Google Workspace or Microsoft 365, and deletion and modification records. Cloud forensics answers the questions device forensics cannot: it is how you prove a departed employee downloaded the client list to a personal account on their last Friday, or how an intruder read a CEO's mailbox for months. Where the compromise traces back to a hacked or scam-operated account, our scam and crypto recovery team can pick up the financial trail the forensics uncovers.
Can deleted data really be recovered? The honest answer
Sometimes yes, sometimes no, and anyone who promises either way before examining the device is guessing. Here is the reality. When a file is deleted, the system usually removes the reference to it, not the data itself, which remains on the storage until overwritten. That is the window forensic recovery works in. But the window varies enormously. On traditional hard drives, deleted data can persist for months. On modern phones and SSDs, storage management (TRIM and flash wear-leveling) can genuinely erase data within hours or days, and full-disk encryption means a wiped or locked device may be unrecoverable by anyone. What shifts the odds in your favor: databases often retain deleted records internally long after the app hides them (deleted texts are frequently recoverable for this reason), cloud backups preserve copies the device no longer holds, and the same message usually exists on the other party's device too. The practical rule: stop using the device immediately, because every minute of normal use overwrites potential evidence, and get it to an examiner fast. We give you a realistic recovery assessment before you spend money, not after.
Chain of custody: why method decides admissibility
Evidence that cannot be trusted is worthless, and courts decide trust by asking how the evidence was handled. A proper chain of custody documents who collected the evidence, when, how, who has touched it since, and how we can prove it was never altered. In practice that means: the original device is acquired using write blockers, hardware that physically prevents the examination computer from changing anything on the evidence drive; a complete forensic image is taken and verified with cryptographic hashes, mathematical fingerprints that prove the copy is exact and remains unaltered; all analysis happens on the copy, never the original; and every transfer and action is logged. This is also why amateur evidence so often dies in court: a phone that has been scrolled through by three people, with screenshots taken weeks apart and no record of handling, invites the simple argument that it was tampered with, and there is no documentation to answer it. If there is any chance your matter ends up in front of a court, an employer, an insurer, or a regulator, how the evidence is gathered matters as much as what it shows.
The legal boundaries: what we will and will not do
This section is blunt because it protects you. Digital forensics is powerful, and the same techniques are illegal when pointed at the wrong target. Our rule is simple: we examine only devices, accounts, and data you own, control, or are legally authorized to access, and we verify that authorization in writing before any work begins.
What qualifies as lawful authorization
- Your own devices and accounts. Always.
- Company-owned devices and accounts, subject to the conditions below.
- Devices with the owner's informed written consent, for example a family member who agrees to an examination.
- Court orders and legal discovery, where a judge or legal process grants access.
- Estates and guardianship, where you hold legal authority over the data.
What we refuse, every time
We do not access a partner's, ex-partner's, employee's, or anyone else's personal phone, email, or social accounts without a lawful basis, no matter how the request is framed and no matter how justified the suspicion feels. Covertly installing spyware on another adult's phone is a crime in virtually every jurisdiction, evidence obtained that way is typically inadmissible and can poison an entire legal case, and it exposes you, not just us, to prosecution and civil liability. Anyone who offers to "get into" someone's phone or accounts for you is either a criminal or a scammer, and frequently both.
Employer monitoring: legal, but only done right
Businesses can lawfully monitor and examine company systems, and we support corporate investigations regularly, but the legal basis has real requirements: the equipment or account should be company-owned or company-controlled, employees must have been notified through an acceptable-use or monitoring policy that reduces their expectation of privacy, the monitoring must be proportionate to a legitimate business purpose, and in some jurisdictions specific consent or works-council involvement is required. Secretly monitoring an employee's personal phone or private accounts is not employer monitoring; it is unlawful surveillance. We help businesses get the policy basis right, and we decline engagements that lack it.
What cases do we investigate?
- Employee data theft. The classic pattern: a departing employee, a USB drive, a personal cloud account, and a competitor. We reconstruct what was taken, when, and how, from device artifacts and cloud logs, in a report your lawyer can act on.
- Fraud and financial wrongdoing. Reconstruction of transactions, communications, and document trails in business disputes, investment fraud, and embezzlement, including handoff to fund tracing where money moved.
- Divorce and family matters, within lawful scope. We examine shared and jointly owned devices and accounts, your own devices, and lawfully obtainable records, and we preserve evidence in admissible form for your lawyer. We do not break into a spouse's personal phone or accounts; in contested family cases, unlawfully obtained evidence routinely backfires and can hand the advantage to the other side. The lawful route is slower and wins more often.
- Harassment, stalking, and blackmail evidence. Preserving threatening messages, profiles, and metadata in court-ready form, and supporting identification of anonymous abusers through lawful means. If the harassment involves intimate images, this runs alongside our content takedown and NCII removal service, and our guide to reporting online blackmail covers the parallel reporting track.
- Insider threat and policy violations. Misuse of company systems, sabotage, unauthorized access, and IP leakage, investigated on company infrastructure with a proper policy basis.
- Compromise investigations. Determining whether your own device or account was hacked, what the intruder accessed, and what evidence of them remains.
OSINT: open-source intelligence investigations
Not every question requires touching a device. Open-source intelligence builds answers from information that is lawfully public: social profiles and their histories, usernames reused across platforms, public records and corporate registries, domain and website registration data, leaked-data indexes, photo metadata and reverse image searches, and archived versions of deleted pages. OSINT is how we unmask fake and impersonating profiles, trace the infrastructure behind scam websites, run background and asset checks, and connect an anonymous harasser's accounts to an identifiable person, all without accessing anything private. The craft is in correlation: one reused username, one photo background, one timestamp pattern can connect an anonymous account to a real identity. Every OSINT finding we report includes how it was reached, from which public source, so the conclusion can be verified rather than taken on faith.
Should you involve a lawyer before the forensics?
Often yes, and we will tell you when. If your matter is heading toward litigation, engaging us through your lawyer can place the investigation under legal privilege, which protects the work product and gives you control over what is disclosed and when. Lawyers can also obtain through legal process what no examiner can lawfully reach directly: subscriber records from platforms, preservation orders against opposing parties, and court-authorized access to devices you do not control. The strongest cases usually pair the two: forensics establishes and preserves what you can lawfully reach today, and legal process extends the reach tomorrow. If you contact us without a lawyer and your case clearly needs one, we say so at the consultation stage rather than letting you spend on analysis that should wait for counsel.
Expert reports and testimony
The deliverable matters as much as the analysis. Every investigation ends with a written report in two registers: a plain-language summary that a manager, judge, or family lawyer can follow without technical background, and a technical appendix documenting methodology, tools, hashes, and every finding's provenance for the expert on the other side. We state clearly what the evidence shows, what it does not show, and what remains uncertain, because an examiner who overstates findings gets destroyed on cross-examination and takes your case down too. Where matters proceed to litigation, we support lawyers with affidavits, declarations, and expert testimony, and we hold up well in that setting precisely because our collection method was built for it from the first day.
Tools and credibility
You should ask any forensics provider what they work with, so here is our answer in plain terms. We use hardware write blockers for all evidence acquisition, industry-standard forensic imaging and verification (cryptographic hashing of every image), commercial-grade examination platforms of the kind used by law enforcement laboratories for phone and computer analysis, and dedicated database and artifact parsers for app data. Tools matter less than discipline, but the combination of recognized tooling plus documented method is what opposing experts and courts look for, and it is the standard we build every case to, even the ones that will never see a courtroom, because you rarely know at the start which ones will.
How an engagement runs, step by step
- Confidential consultation (free). You describe the situation and the question you need answered. We tell you honestly whether forensics can answer it, what the lawful scope is, and what it will cost. Sometimes the honest answer is that you do not need us, or that you need a lawyer first.
- Authorization and scoping. We verify in writing that you have the legal right to the examination, define exactly what is in scope, and agree the question to be answered. Days one to two.
- Preservation and acquisition. Devices are forensically imaged with write blockers and hash verification; cloud data is preserved through proper export and logging. Originals are returned or sealed. Typically days two to five.
- Analysis. Examination of the acquired data against the scoped question: timeline reconstruction, artifact and deleted-data recovery, log correlation, OSINT where relevant. Typically one to three weeks depending on data volume and complexity.
- Reporting. Plain-language findings plus technical appendix, delivered and walked through with you, with the evidence package preserved for any later proceedings.
- Support. Follow-up questions, lawyer liaison, supplementary analysis, and testimony if the matter proceeds.
Urgent matters, a departing employee leaving Friday, a device that must be preserved today, are handled on an emergency basis with same-week acquisition, because preservation is the time-critical step: once the data is imaged and sealed, the analysis can proceed on a normal schedule without risk.
What does a digital forensics investigation cost?
Pricing follows scope, and the main drivers are the number of devices or accounts, the volume of data, the complexity of the question, and whether court-ready reporting or testimony is needed. A focused single-device examination with a defined question is a modest fixed-price engagement. A multi-device corporate investigation with cloud analysis, OSINT, and litigation support is a larger project, usually phased so you can stop after preservation or after initial findings if the early evidence answers the question. Two honest notes. First, preservation is cheap compared to everything else, so when in doubt, preserve now and decide about analysis later; the option expires, the image does not. Second, we quote fixed prices after the consultation and tell you up front when a case is unlikely to produce the answer you want, because charging for an examination we expect to be inconclusive is not a business we want to be in.
Finally, know the difference between us and the ads: people who need evidence are often tempted to contact a hacker to pull data from someone else's phone or email. Those hackers for hire commit crimes that destroy your case, because illegally obtained evidence is inadmissible. Our certified ethical hackers for hire and forensic examiners collect evidence lawfully, which is why it survives in court.