Skip to content
PraetorianX

Digital Investigations & Litigation Support

When something has gone wrong, we find out what happened and prove it

Data taken by departing staff, deleted emails, altered invoices, missing money. We recover the digital trail, preserve it properly, and set it out so your lawyers, board or insurer can act on it.

Call 0467 697 148

Before you do anything else

Suspect someone has taken your data? Do this first.

Don’t

  • Let your IT person or anyone else “have a look” at the device
  • Wipe, reset or hand the laptop or phone to someone new
  • Delete their email or cloud accounts
  • Confront the person or tip them off

Do

  • Leave the device as it is: if it’s on, leave it on; if it’s off, leave it off
  • Suspend their accounts rather than deleting them
  • Write down who has handled the device, and when
  • Call us. Cloud logs are only kept for a limited time

The sooner evidence is preserved, the more we can show. Read the full guide

Call 0467 697 148

What we investigate

The situations we handle most

Data theft & IP

Ex-staff and competitor data theft

Which files were downloaded, synced, emailed or copied to USB, when, and by whom, even if the person deleted the trail.

  • Microsoft 365, Google Workspace, OneDrive and SharePoint activity
  • USB, personal phone and cloud sync records
  • Recovered deleted emails, messages and browser history
Litigation support

Evidence for disputes and court

We work alongside your legal team, preserving evidence with documented procedures and helping frame subpoenas and discovery requests.

  • Documented chain of custody and SHA-256 verification
  • Technical input for subpoenas and preservation orders
  • Clear reports written for a court audience
Fraud & altered documents

Finding what an accounting review missed

Accountants look at the numbers; we look inside the files: hidden document authors, email routing and bank payment files.

  • PDF and photo metadata analysis
  • ABA payment file reconstruction
  • Duplicate and irregular payment tracing
Preservation

Freezing the trail before it disappears

Cloud logs expire and devices get reused. We preserve what matters first, often remotely and the same day.

  • Legal holds on mailboxes and cloud storage
  • Forensic copies of laptops and phones
  • Audit logs exported before they roll off

How it works

Deleting something rarely erases the trail

Computers, phones and cloud systems like Microsoft 365, Google Workspace and Xero leave quiet records behind. Here’s how we turn them into answers.

  1. Step 1

    Preserve

    We secure laptops, phones and cloud accounts before anything else is lost or changed.

  2. Step 2

    Analyse

    We piece together who logged in, what was copied or edited, and when.

  3. Step 3

    Report

    You receive a clear, dated timeline your lawyers, board or insurer can follow.

  4. Step 4

    Support

    We walk your legal team through the findings and support them as the matter progresses.

Every item we collect gets a digital fingerprint (a SHA-256 hash) at the moment of collection, so anyone can later check it hasn’t changed. Our procedures are designed to meet the Evidence Act 1995 (Cth) and the Evidence Act 1906 (WA).

Deliverables

What you receive

Every investigation ends with something you and your lawyers can use, not a pile of technical data.

  • A clear, dated timeline of what happened, written for non-technical readers
  • Every evidence item verified with a SHA-256 hash at collection
  • A full chain-of-custody record
  • A walkthrough of the findings with you and your lawyers
  • Ongoing support as the matter progresses

For legal teams

For lawyers and directors

We turn cloud logs, laptops and mobile devices into clear, verifiable timelines for employment disputes, IP matters, fraud recovery and commercial litigation.

  • Documented chain of custody and SHA-256 integrity verification
  • Identification of IP theft, collusion and diversion of business
  • Technical input for subpoenas, discovery and preservation orders
  • Alignment with the Privacy Act 1988 (Cth) and the APPs
  • PDF/EXIF metadata attribution and ABA payment file reconstruction
  • Independent, documented methodology you can scrutinise

Technical detail

For IT teams

SHA-256 verified acquisition across cloud tenants and physical endpoints to reconstruct data exfiltration.

  • M365 Unified Audit Log and Entra ID sign-in log extraction
  • Chrome session, OneDrive sync and APFS FSEvents analysis
  • OSINT/WHOIS correlation and EXIF/PDF metadata analysis
  • Coordinated preservation that doesn’t disrupt your operations
  • Direct technical liaison between your IT team and external counsel

Case studies

Examples of our investigations

Details are anonymised to protect our clients.

Stolen client lists

The departing manager who set up a rival

The problem: Key clients began moving to a new competitor started by former staff, who said they had taken nothing.

What we found: Cloud records showed thousands of files, including pricing and placement lists, downloaded to a personal phone before and after their final day.

✓ Dated timeline delivered to the legal team

Missing money

Finding what an accounting review missed

The problem: A business suspected hundreds of thousands of dollars in irregular insurance and supplier payments, even after a financial review.

What we found: Hidden properties in PDF certificates and bank payment files showed who created the altered documents, and matched duplicate payments to the minute.

✓ Altered documents traced to their source

FAQ

Investigation questions

What should I do if I think someone has taken our data?
Don’t let anyone “have a look” at the device, and don’t wipe, reissue or reset it. Suspend the person’s accounts rather than deleting them, don’t confront them yet, and call us. Cloud audit logs are only kept for a limited time, so the sooner they are preserved, the more can be shown.
Can your evidence be used in Australian courts?
Evidence is only as strong as the way it was collected. We preserve it using documented forensic procedures, including a SHA-256 “digital fingerprint” taken at collection and a full chain-of-custody record, designed to meet the Evidence Act 1995 (Cth) and the Evidence Act 1906 (WA). Whether evidence is admitted is always a matter for the court, but our process is built so its integrity can be demonstrated.
Can you tell if a former employee copied files to a personal phone or USB drive?
In many cases, yes. Even if files were deleted or browser history was cleared, platforms such as Microsoft 365, OneDrive, SharePoint and Google Workspace keep audit trails, and computers record connected devices. We combine those records to show what was accessed or copied, and when.
How much does an investigation cost?
Every matter is different, so we quote before any work starts. Tell us what’s happening and we’ll explain the options and the cost; there’s no obligation.
How quickly will you respond?
We reply to every enquiry the same business day. If evidence may be lost or someone still has access to your systems, call 0467 697 148 rather than waiting for an email.

Confidential • No obligation • Quotes on request

Talk to us about your situation

Tell us what’s happening in your own words. We reply the same business day, and if evidence might be lost, call. Cloud preservation can usually start the same day.

Phone / Signal0467 697 148 Emailintelligence@praetorianx.au
Call now