Stage 1Acquire
Preserve first
Forensic imaging of phones, laptops, servers and cloud accounts, with hashes and a log that starts the moment the device is handed over.
- Write-blocked imaging
- SHA-256 verification
- On-site or remote seizure
I recover, examine and explain digital evidence for lawyers, companies and investigators — from the first image of a device to the last question in a hearing.
Every step is documented and reproducible: what was seized, how it was preserved, what was found, and what it does and does not prove.
Forensic imaging of phones, laptops, servers and cloud accounts, with hashes and a log that starts the moment the device is handed over.
Timelines, deleted data, messaging, e-mail and access logs — cross-checked across sources so a finding rests on more than one artefact.
Reports written for the reader who has to decide, and expert testimony that survives cross-examination.
Engagements across Switzerland and remotely, under NDA, in German, French or English. Urgent preservation requests are answered the same day.
No engagement letter needed for a first call. Describe the situation; I will tell you what can be preserved and what can be proven.