Day-to-Day Responsibilities
Collect digital evidence from computers, phones, servers and cloud accounts without altering the original data.
Make forensic copies (images) of storage devices and verify them using hash values.
Recover deleted files, logs and messages, and analyse them with specialised forensic tools.
Trace network activity, emails and transactions to establish who did what, and when.
Record every step in a chain-of-custody log and detailed case notes.
Write clear reports for investigators, lawyers and clients, and testify as an expert witness when a court calls for it.
Support incident response teams after hacks, ransomware attacks or data leaks, and advise on closing the gaps that were exploited.


