Harassment · threats · messages received · headers · your own device · police evidence
Harassment and threats received on your own device. The messages sent to you are your evidence; we preserve them properly, with their headers and dates.
If you have received harassing or threatening messages, emails or other communications on your own device, those messages are your evidence, and they are data you are fully entitled to have examined and preserved. The risk is that evidence on a live device degrades, or is lost if the device is damaged or the messages are deleted, so the job is to preserve it properly: to image the device, recover the messages including any that have been deleted, and set them out with their headers, timestamps and metadata, in a form the police or a court can rely on. We examine your own device and your own received communications; we do not, and cannot, trace or identify the sender beyond what the message headers themselves show, and headers can be forged. Where there is a threat, the police are the right first call, and we work alongside that. This is about preserving what was sent to you, properly and credibly.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is you, the person who received the messages, on your own device or from account data you hold and are entitled to. We ask for your proof of ownership of the device and a declaration that the communications were received by you. This is your data, and examining it needs no one else's authority.
Where there is a threat to your safety, the police are the right first call, and we work alongside a police investigation rather than in place of it. If you believe you are being monitored or stalked, there are specialist support services, and we would point you to them; this service is about preserving the evidence of what was sent to you.
We are clear about the limit. We examine the messages as they exist on your device and preserve them; we do not access the sender's device or accounts, and we cannot identify the sender beyond what the message headers show, which can be forged. What we provide is a credible, preserved record of what was received and when.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| What messages you received, and when | The preserved messages, headers and timestamps | Who sent them, beyond what the headers claim |
| Whether messages were deleted | Recovered deleted items, where they survive | Why they were deleted |
| That the record is genuine and unaltered | A hashed, write-blocked preservation | The truth of what a message asserts |
| The claimed origin of a message | The technical headers | That the headers are genuine; they can be forged |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Do not delete anything, and do not reply in a way you would not want seen; preserve the messages as they are.
- Report a threat to the police first; we preserve the evidence alongside their investigation.
- Keep the device as it is and tell us what was received and when, so we can preserve the right material.
A preservation from a write-blocked image with full headers is far more credible than a screenshot, and recovers deleted messages a screenshot cannot.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can you find out who has been sending me these messages?
We can preserve the messages you received and present their headers, but we cannot identify the sender beyond what those headers claim, and headers can be forged. Identifying a sender is a matter for the police, who can seek information from the platforms. We provide the preserved, credible record of what was sent to you.
Why not just use screenshots?
Screenshots can be questioned, because they are easy to edit. A preservation from a write-blocked image, with the messages' headers and metadata and an integrity record, is far more credible, and it recovers deleted messages that a screenshot cannot. It is the difference between an assertion and evidence.
Is this my data to examine?
Yes. Messages received on your own device, on an account you hold, are your data, and examining and preserving them needs no one else's authority. We examine your device, not the sender's.
Should I go to the police?
If there is a threat to your safety, yes, as a first step, and we work alongside a police investigation. If you believe you are being monitored or stalked, there are specialist support services we can point you to. This service preserves the evidence of what you received.
What does it cost?
The standard report preserving and setting out the messages is £800 + VAT for the one device. The first conversation is free.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.