IT forensic expertise and digital expertise
Acquisition of the media, integrity checks, methodical analysis and a technical report: an expert examination conducted so that every finding can be verified and challenged.
In short. An IT forensic examination means acquiring digital material without altering it, verifying its integrity, analysing it according to a documented method, and setting out in a report what it establishes. Its value lies in reproducibility: another expert, with the same copies, must be able to retrace the same steps.
The stages of an expert examination
Acquisition
Copying the medium — disk, smartphone, mailbox, cloud workspace — with a method suited to its nature and condition. The method chosen, and its limits, are recorded.
Integrity and hashing
Each copy receives a SHA-256 cryptographic hash at acquisition. Recomputing it later shows that the copy has not changed since.
Traceability
A chain of custody documents each step: date, time, person, operation, medium. The path of every item can be traced from handover to report.
Analysis
Analysis works on the copies, never on the original. The tools and versions used are stated, as are the hypotheses examined and ruled out.
Technical report
Findings, method, hashes and limits, kept separate from conclusions. Clear for a non-specialist, precise for an opposing expert.
Court-appointed or out-of-court
An expert examination may be ordered by a court, which appoints the expert and sets the terms of reference. It may also be requested by a party — a business, an individual, a lawyer — to clarify a case before or during proceedings, or to settle a dispute amicably.
The two roles are never combined in the same case: a court-appointed expert must be independent of the parties. We make clear from the first conversation in which capacity we act. Lawyers will find how we work on the lawyers and legal teams page.
Who carries out the examination
Examinations are carried out by Jean-Pierre Heymans, entered as a judicial expert in the National Register of Judicial Experts held by the Belgian FPS Justice, under number EXP2018610. The registration is personal: it belongs to the expert, not to the company Cyber Praxis SRL, which trades as Cyber Forensics.
Jean-Pierre Heymans has more than 25 years of experience in cybersecurity, governance and security leadership. Reports and, where relevant, hearings are handled in French, Dutch and English. Cyber Praxis SRL's information security management system is ISO/IEC 27001 certified by SOCOTEC Certification International.
Areas covered
- iOS and Android smartphones — see smartphone forensics
- Computers, disks and removable media
- Messaging, email and online accounts
- Cloud and Microsoft 365 — see cyber investigation
- Systems, networks, telecoms, VoIP and connected devices
- Disputes over data and intellectual property
Frequently asked questions
Can the expert guarantee the report will be accepted?
No. The expert guarantees a method, traceability and a fair account of the findings. The evidential weight of the material is assessed by the court.
Is Cyber Praxis SRL a judicial expert?
No. Registration in the national register of judicial experts is personal: it is that of Jean-Pierre Heymans (EXP2018610). Cyber Praxis SRL is the company that trades as Cyber Forensics.
How much does an expert examination cost?
A targeted examination starts at €250. A full examination — several media, a report for proceedings — is covered by a written quote, provided after the first conversation, which is free.
A case that calls for an expert examination?
First conversation free and confidential. We set out the framework, the method and the cost before any work begins.