Digital forensics in Belgium
What happened, who did what, and when? I investigate computers, servers and phones and establish the facts, based on evidence that is collected and documented properly.
When it helps
- After a cyberattack, to find the initial access and what the attacker did
- For an insurance claim that needs documented facts
- Before or after a police complaint
- Harassment, fraud or internal misconduct cases
- An employee leaves, and you suspect data went with them
How I work
- 01
Scoping
We define the questions to answer, the devices concerned and the legal framework, with your legal adviser when needed.
- 02
Evidence acquisition
Forensic copies of disks, memory and phones, verified by hashes, with a documented chain of custody.
- 03
Analysis
Post-mortem analysis of computers, servers and phones: files, communications, browsing, connections, user activity, memory and network traces.
- 04
Timeline
The facts are put in order, so the sequence of events is clear and every finding points back to its evidence.
- 05
Report
A factual, reproducible report that you can share with your lawyer, your insurer or the police.
What you get
- Answers to the questions agreed at the start, backed by evidence
- A timeline of the relevant events
- Documented evidence: forensic copies, hashes and chain of custody
- A report written to be understood by non-specialists
See an excerpt of a sample incident response reportPDF, 3 pages, in English. Fictitious, anonymised scenario. Request the full 30-page report
Why Cyber Horizon
- GIAC certified in network forensics (GNFA) and digital acquisition (GBFA)
- Industry-standard tools: Velociraptor, KAPE, Volatility, Magnet Forensics, FTK Imager
- Years of hands-on investigation experience
- Discretion: you work directly with me
Frequently asked questions
Can the results be used in court?
The work follows forensic best practices: verified copies, hashes and a documented chain of custody, so the findings can be shared with your lawyer, your insurer or the police. Whether evidence is admissible is decided by the court.
Can you analyse phones?
Yes, Android and iPhone. What can be extracted depends on the model, the operating system version and whether the phone can be unlocked.
Can I investigate an employee's computer?
Internal investigations must respect employees' privacy and Belgian law. I work within the framework agreed with your legal adviser or HR, and only on the questions defined at the start.
How long does an analysis take?
It depends on the number of devices and the questions to answer. After the scoping call, you receive an estimate before any work starts.
What is the difference with incident response?
Incident response manages a crisis in progress. Digital forensics is the in-depth investigation: it supports incident response, and can also be requested on its own, long after the facts.