The situation
A high net worth entrepreneur involved in global markets and politics was subject to a foreign court order requiring the inspection of personal devices. The individual had legitimate concerns about data security and was unwilling to allow devices to leave their premises or data to be transferred to external locations. The court order needed to be satisfied, but the individual’s security requirements had to be respected.
Details in this case study have been altered to protect client confidentiality. The core facts, forensic methodology, and outcomes are accurate.
What we found
The devices contained information relevant to the foreign court order. NDF’s role was to conduct the required forensic acquisition, analysis, and reporting in a manner that satisfied the court’s requirements while ensuring the individual maintained physical control of their data at all times.
How we responded
NDF designed and executed a fully on-site forensic process:
- On-premises acquisition, with all forensic imaging conducted at the individual’s location
- Observed process, with the client’s agents present throughout to verify that no data left the premises and the process was conducted properly
- On-site analysis and reporting, completing all forensic work within the client’s secure environment
- Temporary storage management, with any temporary storage media used during the process left with the client rather than removed
- Rapid execution, completing the entire engagement efficiently to satisfy the foreign court order within the required timeframe
The outcome
The foreign court order was satisfied in full. At no point did any device leave the premises, and all temporary storage remained with the client. The client’s agents were able to observe the entire process, providing assurance that data security was maintained throughout. The engagement demonstrated that forensic compliance with court orders and individual data security requirements are not mutually exclusive.
Lessons for similar organisations
- Court orders and data security can coexist. Forensic acquisition does not require devices to leave the owner’s control. On-site processes can satisfy legal requirements while maintaining security.
- Observation builds trust. Allowing the client’s agents to observe the forensic process addresses concerns about data handling and provides an independent record of how the work was conducted.
- Flexibility in forensic methodology matters. Not every engagement fits a standard process. The ability to adapt forensic workflows to unusual requirements, such as fully on-site operations, is a critical capability for high-stakes matters.