Skip to content
Process

Four steps, no surprises

The process is deliberately predictable. The turnaround starts only once the device, signed documents, payment and required access are all complete.

  1. 01Free

    Mandatory free assessment

    A guided questionnaire of 5 to 7 minutes. You immediately receive a preliminary indicator level with reasons and limitations. A clarification call is arranged only when necessary.

  2. 0250% advance

    Case acceptance and device intake

    We check eligibility and authority, then send the documents and instructions for shipping the device to Zagreb. A visit is possible by appointment only after the assessment; the exact office location is disclosed after intake.

  3. 033–7 working days

    Authorised acquisition and analysis

    Examination of system and application artefacts, connected accounts and known exposures with chain-of-custody records. Findings are separated into verified, anomalies requiring context, inconclusive observations and limitations.

  4. 04Secure delivery

    Report

    A technical report in Croatian or English, delivered through a secure expiring download with the access code sent separately. The remaining 50% is paid before the report is delivered.

Methodology

Examination methodology

Four stages that apply to every case, whatever the scope. The procedure is documented, repeatable and limited to devices and accounts covered by lawful authority.

  1. 01

    Scope and authority

    We confirm lawful authority, device ownership, the requested examination scope, the relevant period and the evidence-preservation requirements.

  2. 02

    Authorised acquisition and integrity

    We document intake and device state, perform the technically appropriate authorised acquisition or export, maintain chain-of-custody records, and create an evidence manifest with cryptographic hash values where relevant.

  3. 03

    Artefact analysis and correlation

    We examine available system and application artefacts, diagnostic records, configuration and profile state, account-access metadata and applicable indicators. Timestamps, event sequences and cross-source observations are correlated.

  4. 04

    Classification and reporting

    Verified findings, anomalies requiring contextual validation, inconclusive observations and limitations are presented separately, together with an incident timeline, the methodology, evidential references and proportionate remediation recommendations.

No formal laboratory accreditation is implied.

Preserving traces

Before you hand over or ship the device

This guidance applies from the moment you become suspicious until the device is packed. If your immediate safety requires something different, safety takes priority.

  1. 01

    Do not factory reset the device

    A reset permanently removes the artefacts the examination relies on.

  2. 02

    Do not delete apps

    Removing an app also removes the records that could document it.

  3. 03

    Do not install major system updates

    Major updates change and discard diagnostic records.

  4. 04

    Do not change passwords from the device in question

    If a password must be changed immediately, do it from a separate trusted device.

  5. 05

    Do not confront the person you suspect

    A conversation before the examination usually leads to traces being deleted and can increase the risk to you.

  6. 06

    Power the device off before packing

    Shut the device down fully before packing it according to the instructions you receive when the case is accepted.

Scope and limitations

What the examination does not cover

  • We do not carry out investigative work and do not identify, track or accuse individuals.
  • We do not promise physical full-file-system acquisition or universal detection of monitoring software.
  • We do not attribute responsibility to any person or organisation.
  • The absence of indicators within the available dataset does not prove that no compromise occurred.
  • A credential-exposure record does not in itself prove device compromise.
Safety notice

If you feel unsafe, safety comes first.

If there is any risk of violence, stalking or coercion, do not examine the device yourself and do not confront the person you suspect. Reach out to people you trust and to the relevant services first, and only then to a technical examination.

  • In an emergency in Croatia, call 112.
  • Contact us from a separate trusted device and a network the other person cannot access.
  • If your immediate safety requires action, safety takes priority over preserving traces.