Party-appointed technical consultancy
Technical support for parties and legal counsel, from initial questions to critical review of evidence and reports.
Scope, activities and limitations ↗DIGITAL EVIDENCE / CYBER-MED
IT Forensics
From digital traces to documented analysis.
A dedicated digital forensics area for parties, legal counsel, organisations and judicial assignments. Clear questions, preserved evidence, explicit findings and limitations.
THE ROLE BEFORE THE TOOL
Three assignment routes.
The technical subject may be the same; appointment, responsibilities and procedural rules differ.
Court-appointed expertise
Technical work in civil court-appointed consultancy and criminal expert examinations, governed by the questions and appointment order.
Scope, activities and limitations ↗Technical consultancy for public prosecutors
Digital examination areas for assignments from public prosecutors, with scope and procedures set by the appointing authority.
Scope, activities and limitations ↗Judicial work requires formal appointment and verification of eligibility and conflicts.
SOURCES AND QUESTIONS
Areas of examination.
From devices to online platforms and multimedia. Every area begins with an assessment of feasibility, expertise and tools required.
Evidence acquisition and preservation
A documented process to identify sources and preserve data relevant to the examination.
Scope, activities and limitations ↗Computers, servers and storage media
System and storage analysis to reconstruct activity relevant to a defined question.
Scope, activities and limitations ↗Smartphones, tablets and messaging
Acquisition and analysis of mobile data and conversations within technical and authorised limits.
Scope, activities and limitations ↗Email, certified email and digital documents
Technical examination of messages, receipts and documents, focusing on metadata, consistency and source provenance.
Scope, activities and limitations ↗Cloud and collaboration environments
Analysis of content, access and activity available in authorised cloud environments.
Scope, activities and limitations ↗Web, social media and OSINT
Collection and analysis of relevant online content with documented acquisition context.
Scope, activities and limitations ↗Communication records and geolocation
Technical analysis of traffic and location data lawfully available within the assignment.
Scope, activities and limitations ↗Forensic audio analysis
Technical examination of recordings and speech intelligibility, subject to assessment of the material.
Scope, activities and limitations ↗Images, video and CCTV
Analysis of media files, sequences and possible alterations, including questions about synthetic content.
Scope, activities and limitations ↗Incidents, networks and malware
Technical reconstruction of cyber incidents using available logs, systems and evidence.
Scope, activities and limitations ↗Corporate investigations, software and intellectual property
Targeted technical analysis of documents, systems and code to clarify events relevant to an organisation.
Scope, activities and limitations ↗Data recovery for forensic purposes
Assessment of recovery possibilities with attention to media preservation and documentation.
Scope, activities and limitations ↗IoT, vehicles and connected devices
Assessment of traces held by connected devices, wearables, onboard systems and drones.
Scope, activities and limitations ↗Blockchain and crypto transactions
Reconstruction of observable public-ledger flows and correlation with materials available within the assignment.
Scope, activities and limitations ↗TRACEABILITY, CONTEXT, CLARITY
A verifiable process.
Analysis quality also depends on documenting operations and explaining conclusions. A hash does not by itself certify that content is true.
- 01
Define
Questions, authorisations, sources and assignment boundaries.
- 02
Preserve
Receipt, custody and documentation of handling.
- 03
Acquire
Source-appropriate methods, logs and integrity checks.
- 04
Analyse
Verifiable correlations and a distinction between observations and hypotheses.
- 05
Report
A readable report with sources, findings, limitations and appendices.
Prepare before an examination is needed
Forensic readiness: identify sources, responsible people, log retention and evidence-handling arrangements. Preparation should align with internal procedures and incident management.
Training and awareness ↗THE METHOD EXPLAINED
Two video guides.
Original explanatory diagrams: the evidence process and the distinction between assignments.
50 S / IT FORENSICS
From source to report
Read the transcript
- Define the technical question, scope and required authorisations before acting.
- Preserve sources and document custody and each handling step.
- Use an appropriate acquisition method. Record operations and hashes where applicable. A hash alone does not prove that content is truthful.
- Analyse and correlate traces, keeping observations distinct from hypotheses.
- The report presents sources, methods, findings and the limitations of the analysis.
40 S / IT FORENSICS
Who appoints the expert
Read the transcript
- A party-appointed technical consultant acts under instructions from the party or their lawyer, within the scope of the mandate.
- In civil proceedings, the court appoints the court technical consultant.
- In criminal proceedings, the judge appoints an expert for the investigations ordered.
- The public prosecutor may appoint a technical consultant. Articles 359 and 360 of the Italian Code of Criminal Procedure govern different types of technical investigation.
Silent videos with Italian on-screen text. Italian and English subtitles and transcripts are available. Diagrams are illustrative and do not represent real cases.
BEFORE THE ASSIGNMENT
Frequently asked questions.
What is the difference between party, court and prosecutor experts?
A party expert assists a party. A CTU is appointed by a civil judge; a perito by a criminal judge. A public prosecutor may appoint a technical consultant. The role depends on the assignment and proceedings, not just the technical subject.
Is a screenshot enough?
It may be useful, but does not automatically replace the source, metadata and contextual documentation. Acquisition methods depend on the question and available data.
Can every deleted item be recovered?
No. Media condition, damage, encryption, overwriting and accessibility may limit or prevent recovery. Feasibility is assessed before work is agreed.
Can I send a phone or confidential documents immediately?
First describe your needs without confidential attachments. Receipt, authorisations, custody and transfer arrangements are agreed specifically.
How are timing and cost determined?
They depend on the questions, data volume, sources, accessibility and urgency. Scope, expected outputs and commercial terms are agreed following initial assessment.
Official references on procedural roles
- Tivoli Court — civil and criminal experts
- Palermo Juvenile Prosecutor’s Office — technical consultants
References consulted on 10 October 2026. This explanatory content does not replace assessment of the case and applicable rules.
IT FORENSICS / CYBER-MED
Start with the question.
Describe the context, device or source and the purpose of the analysis. We will define scope and feasibility before acting.
info@cyber-med.it ↗+39 392 389 3524
Do not attach evidence, health data or confidential documents to the initial enquiry. Transfer arrangements will be agreed afterwards.