NSI Global’s digital forensic method is built on one principle: evidence is extracted from a device, never written to it. Consumer recovery software installs onto the device and writes as it works, which can overwrite the very data you are trying to recover and makes the result difficult to rely on later. Our process is designed so that what we recover can be tested by the other side and still stand.
The NSI Global DFIR-EDM Method
Standard electronic discovery finds and produces what is still there. NSI Global applies the Digital Forensic Incident Response Electronic Discovery Model (DFIR-EDM), a nine-stage method that adds forensic recovery of deleted and obscured material to the discovery process — so that what was removed is recoverable, not simply absent.
- Stage 1 — Technical Planning. We establish what data exists, where it lives and what it is held on, before anything is touched. Scope errors at this stage are the most expensive to correct later.
- Stage 2 — Project Definition. Scope, legal obligations, timelines and deliverables are agreed with counsel, so the work is matched to what the matter actually requires.
- Stage 3 — Collections. Data is captured from devices, accounts and systems using forensically sound methods, with chain of custody maintained from the moment of capture. Planning and collection move together: what is found in collection often refines the scope.
From here the matter runs on two parallel tracks.
- Stage 4 — eDiscovery. Collected material is processed, de-duplicated, indexed and made searchable.
- Stage 5 — Hosted Review. The processed set is made available in a secure review platform, so legal teams can assess relevance and privilege directly.
- Stage 6 — Digital Forensics. In parallel, we forensically examine the collected material for deleted, hidden, altered and obscured data — what a standard discovery process would never surface. This is the stage that distinguishes DFIR-EDM.
- Stage 7 — Expert Services. Findings are documented as expert reports and affidavits, setting out the material examined, the method applied, the limitations and what can and cannot be concluded. Our examiners can give evidence on them.
- Stage 8 — Trial. We support the matter through hearing, including expert testimony where required.
- Stage 9 — Data Destruction. On conclusion, data is destroyed to an agreed standard and the destruction is certified, so holdings do not outlive the matter that justified them.
Why The Method Matters
- We use restricted-access forensic hardware of the kind supplied to law enforcement and government agencies. It extracts data from the device without installing software on it and without overwriting what is already there
- We do not limit ourselves to one piece of forensic equipment, thus giving our clientele the best chances of recovering their data.
- Our examiners are legally qualified as well as technically qualified, so they understand how evidence is tested and can work directly with legal counsel.
- We specialise in digital forensic legal matters and provide legally admissible reports.
- Commonly available recovery software often overwrites the data you are trying to retrieve. Our process and equipment do not write to the device.
- We provide evidence to show that the data has not been manipulated.
- Our lead examiner’s Australian practice has included instructions from law enforcement bodies, prosecuting authorities and the courts. That record is what our UAE work is built on.
- We are instructed by government bodies, multinational corporations, law firms and private clients.