Digital Forensics FAQs
Clear answers to common questions about preservation, recovery, forensic examination and reporting.
Can deleted data always be recovered?
No. Recovery depends on the device, encryption, available acquisition method, elapsed time and subsequent use. A forensic examiner should explain both the results and the limitations.
Should I switch off a device?
Not automatically. The correct action depends on whether the device is on or off, locked or unlocked, encrypted, connected to a network and at risk of remote change. Obtain case-specific advice where possible.
Can I send evidence through WhatsApp or email?
Avoid sending original evidence through services that may compress, rename or alter files. Secure transfer arrangements should be agreed before evidence is supplied.
Are screenshots sufficient evidence?
Screenshots can be useful, but they often omit metadata, headers, account context and surrounding records. Native files, databases or forensic acquisitions usually provide stronger evidence.
Do you provide expert reports and testimony?
Digital Detective can provide scoped forensic reports, affidavits, consultations and expert testimony where appropriate to the instruction and evidence examined.
Do you work outside Cape Town?
Digital Detective serves clients across South Africa. The appropriate intake, secure transfer, travel or remote consultation arrangements depend on the evidence and matter.