What Is The Unique NSI Digital Forensic Methodology

NSI Global’s digital forensic method is built on one principle: evidence is extracted from a device, never written to it. Consumer recovery software installs onto the device and writes as it works, which can overwrite the very data you are trying to recover and makes the result difficult to rely on later. Our process is designed so that what we recover can be tested by the other side and still stand.

Our Five-Stage Method

1. Preserve. The device or account is secured before anything is examined, so that normal use cannot alter what is recoverable.
2. Extract. Data is read from the device using forensic hardware, with no software installed on it and nothing written to it. We are not tied to a single tool — using several gives a better chance of recovering what one alone would miss.
3. Verify. We record evidence that the data has not been altered between extraction and examination, so integrity can be demonstrated rather than asserted.
4. Examine. Recovered material is analysed by examiners who work to evidentiary standards and can work alongside legal counsel.
5. Report. Findings are set out with the material examined, the method used, the limitations, and what can and cannot be concluded from the evidence.

Where a matter proceeds to litigation, this examination work sits inside our nine-stage DFIR-EDM discovery method.

Why The Method Matters

• We use restricted-access forensic hardware of the kind supplied to law enforcement and government agencies. It extracts data from the device without installing software on it and without overwriting what is already there.
• We do not limit ourselves to one piece of forensic equipment, thus giving our clientele the best chances of recovering their data.
• Our examiners are legally qualified as well as technically qualified, so they understand how evidence is tested and can work directly with solicitors and counsel.
• We specialise in digital forensic legal matters and provide reports prepared to be relied on in proceedings.
• Commonly available recovery software often overwrites the data you are trying to retrieve. Our process and equipment do not write to the device.
• We provide evidence to show that the data has not been manipulated.
• We are regularly instructed by Australian law enforcement bodies, prosecuting authorities and the courts for deleted data recovery.
• We are instructed by government departments at all levels, multinational corporations, law firms and private clients.

Engagements are scoped and overseen by founder Navid Sobbi and delivered in-house by NSI Global’s own practitioners — never subcontracted. Confidential consultations can be arranged at our Parramatta head office or at our Double Bay, Melbourne or Canberra offices, by appointment.

Please note: we examine devices and cloud accounts only with the lawful authority of the owner or account holder, and in line with the Privacy Act, the Surveillance Devices Act and applicable legislation.

NSI Global will not interfere with, or accept any assignment from, a client who is the subject of a law enforcement investigation