01
Computer & Mobile Forensics
Forensic imaging and examination of Windows, macOS, Linux, iOS and Android devices; file-system, registry, artefact, internet-history and timeline analysis; live memory acquisition and volatile-data analysis.
Professional profile
Twenty years of evidence that holds up in court
My practice spans the full evidential lifecycle: identification, forensically sound preservation and acquisition, examination, analysis, and the presentation of findings in reports that comply with CPR Part 35 (civil) and CrimPR Part 19 (criminal). I give oral evidence in the Crown Court and civil courts, work to NPCC (formerly ACPO) principles for digital evidence within an NPCC · ISO 17025 aligned practice, and advise on GDPR/DPA-compliant incident analysis and PCI DSS forensic investigations.
Beyond casework I lead CFL's Cyber Forensics Research Group, direct the firm's e-discovery and disclosure service (Relativity, Nuix and EDRM-aligned workflows), and publish regularly on admissibility, reliability and forensic practice for legal professionals.
Instructed by prosecution and defence in criminal matters and by claimants and defendants in civil litigation. I produce an expert report approximately every two weeks and attend court regularly to give evidence, answer questions under cross-examination and participate in joint expert discussions and statements.
Areas of expertise
Six disciplines, one evidential standard
Every instruction is handled under the same chain-of-custody, examination and reporting discipline, whatever the device or dispute.
02
E-Discovery & E-Disclosure
End-to-end EDRM workflows for CPR PD 57AD / PD 31B disclosure and US federal litigation: collection, processing, early case assessment, review hosting, production and disclosure statements.
03
Document, Email & Media Authentication
Validation of disputed documents (wills, contracts, deeds, bank statements), email headers and provenance, images, audio and video recordings; detection of manipulation and metadata tampering.
04
Cybercrime & Incident Forensics
Hacking and intrusion investigations, malware and binary analysis, network and firewall log analysis, PCI DSS forensic investigations, GDPR/DPA breach analysis and reporting.
05
Advanced Data Recovery
Recovery from failed, damaged or wiped media including NAND, SSD, memory cards and chip-off; bit-level analysis and data carving; anti-forensics detection.
06
Cloud, Social Media & OSINT
Preservation and analysis of cloud accounts, messaging platforms and social media; open-source intelligence investigations supporting litigation and defence disclosure.
Expert witness practice
Instructed, reported, cross-examined
Cases handled or supervised have included matters reported in the national press. Reports are written to the duties owed to the court, with the reasoning, the limits of the evidence and any competing explanations set out plainly, and are prepared for joint expert discussions and oral evidence from the outset.
- R v Nana OppongCrown Court murder proceedings
- R v Codee GodreyCrown Court proceedings
- R v Merje & MngoyCrown Court proceedings
- R v Bonaventure Chukwuka£10m fraud, Blackfriars Crown Court
- Caroline Astrid ColeHigh Court, disputed and forged email evidence
- Civil, family, employment and commercial disputesNumerous instructions
Media: 999: Murder Calling
Contributing digital forensics expert in the six-part crime documentary series (Discovery+ and Amazon Prime), discussing the role of digital evidence in solving murder investigations.
Typical matters handled or supervised
- Company data and IP theft; employee misconduct and contractual disputes
- Digital document, email and audio-visual authentication where evidence is disputed
- Online banking, email-impersonation and computer fraud investigations
- Forged wills, contracts, title deeds, powers of attorney and bank statements
- Indecent-image cases for law enforcement, prosecution and defence firms
- Harassment, stalking, trolling and defamation evidence gathering
- Data-protection and GDPR regulatory-compliance investigations
- Family, divorce and employment-tribunal digital evidence
Tools and technologies
Validated tooling across every evidence type
Forensic suites
EnCase, X-Ways Forensics, FTK / FTK Imager, Magnet AXIOM, Autopsy / The Sleuth Kit, CAINE, DEFT
Mobile forensics
Cellebrite UFED, GrayKey, Oxygen Forensic Detective, MSAB XRY, MOBILedit, Avilla Forensics
E-discovery & review
RelativityOne, Nuix, EDRM-aligned processing and production pipelines
Data recovery
ACE Lab PC-3000, Rusolut NAND adapters, R-Studio, Recovery Explorer, Foremost, chip-off and NAND reconstruction
Binary & malware analysis
010 Editor, hexedit / xxd / hexdump, IDA Pro, OllyDbg, memory-dump analysis, reverse-engineering concepts
Platforms & development
Windows, Unix/Linux and macOS environments; Python tooling for OSINT and forensic automation; C programming; Microsoft development stack (MCSD)
Professional experience
Career
2007 to presentComputer Forensics Lab Ltd, London
CEO & Founding Digital Forensic & E-Discovery Expert
Computer Forensics Lab Ltd
- Founded the digital forensics division and lead all expert witness instructions in civil (CPR Part 35) and criminal (CrimPR Part 19) matters, from initial instruction and LAA prior-authority quotations through to oral evidence.
- Supervise a team of eight forensic and e-discovery specialists; set and maintain the firm's technical procedures, quality standards and chain-of-custody controls in line with NPCC principles and ISO 17025-aligned practice.
- Direct forensic acquisition and examination across computers, mobile handsets, vehicles, CCTV, cloud accounts and network infrastructure, producing court-ready reports on the instructions of solicitors, counsel and investigators.
- Lead the e-discovery/e-disclosure service, including document review and production programmes for UK litigation and US federal proceedings hosted on RelativityOne and Nuix.
- Head the Cyber Forensics Research Group (CFRG): research into current examination methods, expert training, and development of tools and best-practice frameworks for computers, phones, embedded systems and IoT devices.
2003 to presentData Recovery Lab, London
Data Recovery Specialist & Lab Lead
Data Recovery Lab, London (now part of Computer Forensics Lab Ltd)
- Established the data recovery laboratory in 2003; train, supervise and lead the lab's engineers and technicians in logical, physical and chip-off recovery.
- Design architectural and integration improvements to laboratory workflow, tooling and working practices, providing the forensically sound recovery capability that underpins CFL casework.
1996 to 1999BBC World Service
Producer / Presenter
BBC World Service, Bush House, London
- Produced and presented news and current-affairs programming with a primary focus on Iran and the Middle East, managing a team of five to six journalists and assistant producers.
- In 1999 joined the consultation team commissioned to devise the digital format for presenting news that later became BBC News Online.
Education & certifications
- MSc Computer Science (incl. C programming)Tehran Technical College, 1991
- BSc History of Western PhilosophyFerdowsi University, Mashhad, 1984
- EnCE, EnCase Certified Examiner
- CISSP, Certified Information Systems Security Professional
- MCSD, Microsoft Certified Solution Developer
- MCP, Microsoft Certified Professional
Training & memberships
- Magnet Forensics Cyber, formal training
- GrayKey (Magnet), formal training
- SANS Institute, digital forensics training
- BCS, The Chartered Institute for IT, Professional Member (MBCS)
- IEEE Computer Society, Member
Publications & research
- Digital Evidence in the Dock: Admissibility, Reliability and Forensic Practice for Lawyers and the Public (Medium)
- Regular articles on digital forensic practice for legal professionals at computerforensicslab.co.uk and cforensicslab.medium.com
- Research profiles: ORCID 0000-0002-0366-0392, ResearchGate, Academia.edu (distributed-ledger technology and digital evidence)
Curriculum vitae
Professional CV
Three pages, current as of September 2026. The same document solicitors receive with an instruction.
Writing
Notes on digital evidence
Digital Evidence in the Dock: Admissibility, Reliability and Forensic Practice for Lawyers and the Public
What a court needs before it can rely on digital material, and where forensic practice most often falls short of it.
Read on Medium →What can a computer forensics investigation reveal?
Computer technology is the major integral part of everyday human life, and it is growing rapidly, as are computer crimes such as financial fraud, unauthorised intrusion, identity theft and intellectual theft.
Guides and articles for legal professionals
Regular articles on digital forensic practice, admissibility and disclosure, published through Computer Forensics Lab.
Browse on Medium →Instruct
Get in touch
For a view on whether digital evidence will help your case, a short call before instruction usually saves time later. Please call and make an appointment before attending the office.
No marketing approaches, please.
Office
Computer Forensics Lab Ltd
Euro House, 133 Ballards Lane
Finchley, London N3 1LJ
Hours
Monday to Friday
09:30 to 18:00
Closed on bank holidays