National Reach from Two Metro Vancouver Offices
Sherlock Forensics operates from offices in Burnaby and Coquitlam, British Columbia. But our client base extends across every province and territory in Canada. Digital forensics does not require geographic proximity for most engagements. Modern remote forensic tools allow us to collect, preserve and analyze digital evidence from anywhere with a network connection.
When a case requires physical presence for evidence collection, we travel. We have conducted on-site forensic collections in Vancouver, Calgary, Toronto, Montreal, Halifax, St. John's and communities in between. No location in Canada is outside our service area.
Court-Qualified Forensic Expertise
Ryan Purita, our principal examiner, holds CISSP, ISSAP and ISSMP certifications and has been qualified as an expert witness in courts in British Columbia and Newfoundland. Court qualification means a judge has formally accepted our examiner as an expert in digital forensics, allowing testimony on forensic findings, methodology and conclusions.
This matters because forensic evidence is only as valuable as its admissibility. A forensic report from a qualified examiner carries weight with judges, opposing counsel and juries. A report from an unqualified source can be challenged and excluded entirely.
Our forensic reports follow standards accepted by Canadian courts. Chain of custody documentation, forensic imaging verification, detailed methodology descriptions and conclusions supported by evidence. Every report is written to withstand cross-examination.
What We Investigate
Our forensic investigation services cover the full range of digital evidence matters:
- Computer forensics: Hard drive imaging and analysis, deleted file recovery, timeline reconstruction, email analysis and internet activity examination.
- Cellphone forensics: Mobile device extraction, text message recovery, app data analysis, GPS location history and social media artifact recovery.
- Incident response: Active breach containment, malware analysis, lateral movement tracking, data exfiltration assessment and forensic preservation during live incidents.
- Data breach investigation: Determining what was accessed, when, by whom and what data was affected. Notification requirements assessment under PIPEDA and provincial privacy legislation.
- Employee misconduct: Intellectual property theft, unauthorized data access, policy violation investigation and departing employee forensics.
- eDiscovery: Electronic document identification, preservation, collection, processing and review for litigation support.
- Fraud investigation: Financial record analysis, communication pattern review, timeline reconstruction and evidence assembly for prosecution or civil action.
Remote Forensic Capabilities
Remote forensic collection is not a compromise. For many case types, it is the superior approach. Remote collection is faster because there is no travel time. It is less expensive because there are no travel costs. And it maintains chain of custody through automated logging that documents every action taken on the evidence.
Our remote capabilities include:
- Forensic imaging of workstations and servers over encrypted connections
- Cloud environment forensics for AWS, Azure and Google Cloud
- SaaS application data preservation from Microsoft 365, Google Workspace and other platforms
- Network traffic capture and analysis
- Memory acquisition from live systems
For cases involving physical devices that cannot be accessed remotely, such as locked mobile phones, damaged hard drives or air-gapped systems, we provide on-site collection. We ship forensic imaging equipment to the location or travel with our own lab-grade hardware.
Working with Law Firms Across Canada
A significant portion of our forensic work comes from law firms handling civil litigation, family law matters, employment disputes and criminal defense. We work with counsel to scope forensic examinations that answer the specific questions relevant to their case.
Our process for law firm engagements:
- Initial consultation to understand the case and identify relevant digital evidence
- Forensic preservation of all identified evidence with full chain of custody
- Targeted analysis focused on the questions that matter to the case
- Detailed forensic report suitable for court filing
- Expert witness testimony if the matter proceeds to trial
We have worked with firms ranging from sole practitioners to national firms. The process scales to the complexity of the matter.
Corporate Investigations
For corporate clients, forensic investigations typically involve employee misconduct, data breach response, intellectual property theft or regulatory compliance matters. We work with internal counsel, HR departments and executive leadership to conduct investigations that are thorough, defensible and discreet.
Corporate investigations often require speed. A departing employee with access to customer data or trade secrets creates a time-sensitive situation. Our remote capabilities allow us to begin evidence preservation within hours of engagement, not days.
Engage Sherlock Forensics
Whether you are a law firm in Toronto, a corporation in Calgary or a government agency in Ottawa, we provide the same level of forensic expertise and court-ready reporting. Over 20 years of field experience. Court-qualified examiner. National reach.
Call 604.229.1994 or contact us online to discuss your investigation.