Digital forensics and incident response since 2003, from law enforcement support and the courtroom to leading national response teams and security functions. Now available directly through Cognisn.
For solicitors, counsel, insurers and the courts. Every engagement is approached on the basis that the work may be tested in court, by an opposing expert or by a regulator.
Independent expert opinion on digital evidence, prepared for the court rather than for a side. Matthew Westwood-Hill has prepared expert reports and given evidence for more than ten years, across hundreds of matters.
Reports are prepared in accordance with the Federal Court's Expert Evidence Practice Note (GPN-EXPT), the Harmonised Expert Witness Code of Conduct and the equivalent state codes. The expert's paramount duty is to assist the court impartially, not to advocate for the party that retains them.
Typical matters include:
Forensically sound acquisition and examination of computers, mobile devices, email and cloud accounts, with documented methodology and chain of custody, so that findings can be reproduced by another examiner and relied on by the court.
This work began in 2003, combining computer forensics with training in questioned document examination, a grounding that still informs matters about the authenticity of documents and signatures. Credentials include the GIAC Certified Forensic Analyst (GCFA) and AccessData Certified Examiner (ACE).
Defensible handling of electronically stored information across the whole process: collection, processing, review and production, on platforms including Nuix and Relativity. Experience spans independent practice, a national law firm's litigation support group and large-scale matters for multinational clients, so the work is shaped around how legal teams actually run a matter.
An experienced trainer in forensic analysis and eDiscovery, available to train legal, investigation and security teams in sound evidence handling, analysis techniques and the platforms they use.
When an incident is under way, decisions in the first hours shape everything that follows: the evidence that survives, what must be notified and to whom, and what it costs. If your incident is active now, choose "Active incident, needs help now" on the enquiry form and it will be prioritised.
Leadership of the response from the first hours, engaged directly by organisations, by their law firms or by their insurers, and coordinating across all of those parties. Experience includes leading large-scale responses for multinational organisations in the telecommunications, energy, industrial and government sectors, covering ransomware, cloud compromise and targeted intrusion.
Experience across more than a dozen negotiations with threat actors, covering negotiation strategy, preparation of responses, and conducting the negotiations themselves.
Senior security leadership without a full-time hire, and engineering where off-the-shelf tools fall short.
Drawing on experience as a Global CISO and as the leader of a national broadcaster's security function, ongoing or fixed-term security leadership for organisations that need it at board and executive level. That includes having led security engineering, operations, incident response and architecture teams, and briefing boards, executives and government agencies including ASD and the ACSC.
Software engineering for security and evidence work, from the same practice that publishes open source tools used on engagements. Background includes leading commercial software teams building enterprise forensic and data discovery products, and originating a deep and dark web monitoring platform recognised in EY's global innovation programme.