Short answer: Choose a provider who follows a documented forensic methodology, keeps a chain of custody, reports in plain language, and is honest about what can’t be recovered. Triage Forensics provides independent mobile forensics for workplace investigations on exactly that basis.
If you’re still deciding whether you need forensics at all, start with our guide to digital forensics for workplace investigations. If you’re ready to engage someone, use the questions below.
Eight questions to ask a provider
- How will you preserve the device before examination? Listen for a clear answer about isolating it from networks and documenting its handling.
- Will you work on the original phone or a forensic copy? The answer should be a verified copy.
- Which tools do you use, and how do you check their results? Good providers validate tool output rather than relying on it blindly.
- What will the report look like? Ask for a sample or an outline. It should explain methodology, findings and limitations in plain language.
- Could the report be used in the Fair Work Commission or a court? Even if you don’t expect that now, the report should be built for it.
- How do you limit the search to what’s relevant? Important for privacy and for cost.
- What’s the realistic timeframe? Expect a confirmed date, with urgent options for hearings that are close.
- Are you independent of the people involved? Any connection to either party is a problem.
Red flags
- Guarantees that deleted messages will be recovered.
- Offers to “just have a quick look” at the phone.
- No written scope or no mention of chain of custody.
- Reports that list raw data without explaining what it means.
Before you make contact
Have the device details, the allegation in a sentence or two, and your key dates ready. Preserve the phone and stop it being used. It’s also worth confirming you have a lawful basis to examine the device, particularly if it’s personally owned.
Frequently asked questions
What should I look for in a mobile forensics provider?
A forensic methodology, a documented chain of custody, court-ready reporting, plain-language communication and honesty about what can’t be recovered.
Why act quickly when suspicion arises?
The more a device is used after an incident, the more recoverable data may be overwritten. Preserve devices early, before analysis begins.
Getting started
Contact Triage Forensics and ask us these eight questions. We’ll answer each one before you commit.