About me — Piotr Wichrań
I help law firms, businesses and individuals with matters in which technology becomes evidence, a source of liability or the subject of a dispute.
I am a court expert in IT, a licensed private investigator and an IT/OT cybersecurity specialist with more than 20 years of experience. I bring these perspectives together to explain events, assess digital material and help clients make decisions based on findings that can be checked.
I have prepared and reviewed more than 2,000 expert opinions and assessments of digital material used in proceedings, investigations and disputes. I draw on this experience both when examining devices and data and when independently reviewing the work of other experts.
Experience that helps identify the right questions
Technology-related matters often raise very specific questions: whether data was altered, where a file came from, who had access to a system, what happened before an incident and whether an expert opinion is supported by the examination. Answering them requires an understanding of how devices and software operate, as well as how digital traces are created and preserved.
My work brings these elements together into an explanation that can be followed and checked. I examine the origin of the material, its completeness, how it was preserved and its context. I also identify limitations: missing data, uncertainty in the findings and alternative explanations that cannot be ruled out.
More than 20 years in technology environments helps me assess digital material in the context of how systems actually work. Configuration, permissions, organisational processes and users’ decisions all matter. A single log entry or extract from correspondence needs to be considered alongside the other available information.
Three perspectives in one practice
Court expert in IT
This perspective requires particular care with methodology and the basis for each conclusion. I examine what material an analysis relied on, which procedures were performed and whether the account of the examination allows the expert’s reasoning to be reconstructed.
When preparing or reviewing opinions, I distinguish between facts, interpretations and hypotheses. I explain the technical aspects of a matter in language that lawyers and decision-makers can understand, while retaining precision and identifying the limits of what can be established.
Licensed private investigator
An investigative perspective helps me organise information, establish its sources and identify connections between events. Understanding the circumstances matters: who had possession of a device and when, how files were obtained and what happened before the material was submitted for analysis.
This approach helps identify what additional information could resolve uncertainties. It also helps recognise situations in which existing traces should be preserved before any further steps are taken.
IT/OT cybersecurity specialist
I draw on experience with information systems and operational technology, including industrial environments, when analysing incidents, IT disputes and digital risk. I consider the relationships between security, system availability, organisational operations and the ability to reconstruct an event.
For a business owner or management team, technical findings need to inform practical decisions. I help establish what is known, what still needs to be checked and which information should be retained so that the actions taken can later be explained.
Reviewing expert opinions and IT reports
Independent review is an important part of my work. I assess how data was preserved, whether the examination was complete, the methodology used and whether the conclusions are supported by the source material.
A review may cover:
- the origin of data and the records of its acquisition and transfer;
- the integrity of the material and how copies were prepared for analysis;
- whether the methods and tools were appropriate for the questions being asked;
- the completeness of the examination and use of available sources;
- consistency between findings, timelines and final conclusions;
- omissions, uncertainties and alternative hypotheses that require examination.
I help prepare questions for an expert and technical observations or objections concerning an opinion. I identify which conclusions are supported by the examination and which require further work or explanation. An independent review may also confirm that an opinion is sound: my assessment follows the available material and the reliability of the methods used.
More about expert opinion review →
Preserving and examining digital material
I work with phones, computers and storage media, as well as material from email, messaging applications, files, metadata and logs. I tailor the examination to the questions in the case and the technical capabilities of each source.
Starting a device incorrectly, opening a file or performing analysis directly on the source material can change metadata, erase traces and make the data harder to use later. How material is handled therefore matters before the examination itself begins.
I consider the condition of the device, encryption, available backups and any previous actions. Not all data can be recovered, and the absence of a trace does not always rule out an event. I explain these limitations so that the client understands the basis on which conclusions can be drawn.
Explore digital evidence preservation, smartphone examination and computer examination.
Working with law firms
I support law firms on individual matters and through ongoing engagements. I can assist with an initial assessment of material, review an expert opinion once it has been received, help prepare technical questions or advise when additional data needs to be preserved.
I organise the technical issues so that it is clear which findings are supported, where inconsistencies arise and what is still missing from a fuller assessment. This helps communication between the lawyer, client and expert and makes it easier to define the scope of further work.
Through an ongoing engagement, I provide technical support for matters involving digital evidence, electronic devices, expert opinions and IT disputes. The scope and terms are agreed according to the firm’s needs.
Ongoing technical support for law firms →
Supporting businesses and private clients
I help businesses investigate technology-related incidents and disputes, analyse available data and assess digital risks. In IT disputes, technical facts and documentation are central. During incident response, preserving the traces needed to reconstruct the event is also important.
Through cyber due diligence, I support risk assessment before a transaction, investment or significant business decision. I help identify areas requiring clarification and explain their significance for the organisation.
For private clients, I assist with matters in which a phone, computer, correspondence or other data may help establish relevant circumstances. The initial conversation establishes what material is available, what can be examined and how the device should be handled. Technical terminology is not required: a description of the situation and the questions you need answered is enough.
How I work
- Define the objective. We discuss the situation, the available material and the questions that need to be answered.
- Assess possibilities and limitations. I identify which steps are justified and whether data needs to be preserved first.
- Agree on scope. We establish the form of the engagement, material transfer arrangements, timing and pricing.
- Analyse the material. I connect findings to their sources, examine hypotheses and identify uncertainties.
- Explain the results. I deliver the agreed assessment and discuss what follows from it and which questions remain open.
Rigour, discretion and clear communication
I want clients to understand the basis for the conclusions presented to them. I explain what was examined, what supports the assessment and which limitations affect its scope. If the material is insufficient, I state that directly.
Discretion and responsible handling of information are part of my working approach. At the outset, we agree on how material will be transferred and what data is needed. Detailed documents and device contents are best provided once an appropriate transfer method has been agreed.
My role is to provide a reliable technical basis for further decisions. In every matter, I return to the same question: what can actually be established from the available data?
Let’s discuss your case
If you need an expert opinion reviewed, a device preserved, an event explained or ongoing technical support, start with a short description of the situation. Mention what material you have and whether there is a relevant deadline.
Phone: +48 515 601 621
Email: biuro@wichran.pl