Scams & Fraud
What to Do After an Online Scam
Immediate steps to protect your accounts, preserve useful digital evidence and avoid making the situation worse.
Digital Forensics Resources
Practical guidance.
Before evidence disappears.
Clear, practical resources for people dealing with digital incidents, investigations and evidence. Learn what to preserve, what to avoid and when specialist forensic support may help.
Featured Guides
Start with the situation you are facing.
Our guides explain the forensic side of common incidents in plain English, with practical steps designed to protect evidence and reduce avoidable mistakes.
Evidence Preservation
How to Preserve Digital Evidence
A practical introduction to protecting digital material so it remains useful, explainable and defensible.
Cyber Incident
What to Do After a Data Breach
Contain the incident while preserving the logs and system evidence needed to understand what actually happened.
Downloadable Incident Help Sheets
What to do in the first few hours.
Printer-friendly, two-page checklists for fast-moving incidents. Keep them, share them internally or use them as a first-response prompt before specialist advice is available.
PDF Help Sheet
Online Scam or Fraud
What to preserve, who to contact and what not to delete after a suspected scam.
Download PDF ↓
PDF Help Sheet
Business Email Compromise
Immediate actions for invoice diversion, mailbox compromise and executive impersonation.
Download PDF ↓
PDF Help Sheet
Ransomware Incident
Contain affected systems while protecting logs and evidence needed for investigation.
Download PDF ↓
PDF Help Sheet
Account Hacked
Secure the account while preserving login history, alerts, sessions and account changes.
Download PDF ↓
PDF Help Sheet
Harassment or Threatening Messages
Preserve messages, account identifiers and context without escalating contact.
Download PDF ↓
PDF Help Sheet
Suspected Employee Data Theft
Protect company evidence before devices, logs or accounts are changed.
Download PDF ↓Important: These sheets provide general first-response guidance. They are not legal advice, and urgent safety, banking or regulatory matters should be escalated to the appropriate authority or professional.
All Guides
Build a better understanding of digital evidence.
Scams & Fraud
What to Do After an Online Scam
Immediate steps to protect your accounts, preserve useful digital evidence and avoid making the situation worse.
7 min readRead guide →
Evidence Preservation
How to Preserve Digital Evidence
A practical introduction to protecting digital material so it remains useful, explainable and defensible.
8 min readRead guide →
Cyber Incident
What to Do After a Data Breach
Contain the incident while preserving the logs and system evidence needed to understand what actually happened.
8 min readRead guide →
Communications Analysis
Understanding Call Detail Records
What CDR data can show, what it cannot show, and why careful interpretation matters.
6 min readRead guide →
Mobile & Communications
How Deleted Messages Can Be Recovered
Why deletion does not always mean disappearance, and what affects the chances of recovering message evidence.
7 min readRead guide →
Email Forensics
Email Evidence in Investigations
Why the message body is only part of the evidence and how headers, routing and account activity add context.
7 min readRead guide →
Mobile Device Forensics
Mobile Phone Forensics: What to Expect
What happens during a professional mobile examination and why scope, access and preservation all matter.
7 min readRead guide →
Evidence Integrity
Chain of Custody for Digital Evidence
How a clear handling record supports confidence in where evidence came from and what happened to it.
6 min readRead guide →
Before Examination
Preparing a Device for Forensic Examination
What to do - and what not to do - before handing over a computer, phone or storage device.
5 min readRead guide →
Expert Reporting
What a Digital Forensic Report Contains
The key elements that make a forensic report clear, useful and capable of being scrutinised.
6 min readRead guide →
Business & HR
Suspected Employee Data Theft: First Response
How to protect evidence and contain risk when an employee may have copied, removed or misused company information.
8 min readRead guide →
Social & Online Evidence
Social Media Evidence: Preserve It Before It Disappears
Practical steps for preserving posts, profiles and messages with enough context to remain useful later.
6 min readRead guide →
Not sure where to start?
Protect the source before you investigate it.
If a device, account or digital record may matter, avoid unnecessary changes. Keep the original material available, record what happened and preserve the wider context rather than only isolated screenshots.
Need forensic support?
Tell us what has happened.
We can help you assess what evidence may exist, how it should be preserved and the most appropriate next step.