FAQ

Digital forensics (also known as computer forensics or informatyka śledcza in Polish) is the scientific discipline that deals with identifying, preserving, analysing, and presenting digital evidence in a manner that maintains its integrity and admissibility in court or internal corporate investigations.

It is most commonly used in the following situations:

• Data leaks and theft of trade secrets
• Employee misconduct or fraud (unauthorised data access, sabotage, etc.)
• Cyberattacks (ransomware, phishing, APT, malware infections)
• Determining the source and scope of a breach
• Recovery of deleted or hidden data
• Civil and criminal litigation requiring digital proof
• Internal corporate investigations and compliance audits

Key principle

Every step of the forensic process must preserve the chain of custody and follow recognised standards (ISO/IEC 27037, NIST SP 800-86, Polish procedural requirements, etc.) so that the evidence and findings are fully admissible before a court.

Preserving digital evidence is the first and most critical phase of any forensic investigation. The goal is to create a perfect, verifiable copy of the original data without altering even a single bit.

Standard forensic preservation process (ISO/IEC 27037 compliant)

1. Physical seizure & documentation
   Photograph the device/scene, record serial numbers, port status, time and persons present.

2. Creation of a forensic (bit-for-bit) image
   The entire storage medium (hard drive, SSD, phone, USB stick, cloud backup, etc.) is duplicated at the physical level using write-blockers (hardware or software).

3. Integrity verification
   Cryptographic hashes are calculated both for the original and the copy:

   • SHA-256 (mandatory)
   • MD5 or SHA-1 (additional)
     If even one hash differs → the copy is invalid.

4. Chain-of-custody documentation
   Detailed protocol containing: who, what, when, where, which tools (with serial numbers and calibration status), hash values, storage location.

5. Secure storage
   The verified forensic image is stored on encrypted media in an access-controlled evidence room or secure cloud vault. The original device is sealed and stored separately.

Critical rule

Never power on, browse, or connect the original device to any computer before professional imaging.
Even opening a single file can overwrite deleted data and destroy its evidentiary value in court.

No – you should absolutely not open, power on, or browse the storage device yourself before handing it over to a forensic expert.

Even seemingly harmless actions can:

• change critical timestamps (last accessed, modified, MFT change times)
• overwrite deleted files or unallocated space
• trigger anti-forensic mechanisms or encryption routines
• destroy or seriously weaken the evidentiary value of the data in court

Correct procedure

1. Leave the device exactly as it is (do not switch it on, do not connect it to a computer).
2. If it is running — do not switch it off either (pulling the plug is safer than a normal shutdown).
3. Hand the device over in its original state.
4. The forensic expert will create a verified bit-for-bit forensic image (with SHA-256/MD5 hashes) and perform all analysis on that copy only.

Following this simple rule very often decides whether the evidence will be accepted by the court or rejected as “contaminated”.

Almost any electronic device that stores or processes data can become a source of digital evidence. The most common include:

• Computers & laptops (Windows, macOS, Linux)
• **Smartphones & tablets (iPhone, Android, iPad)
• External drives, USB sticks, memory cards
• Servers (on-premise, virtual, cloud – AWS, Azure, Google, OVH, etc.)
• Cloud accounts (Google Drive, iCloud, OneDrive, Dropbox, corporate Office 365/GSuite)
• Industrial control systems (OT/ICS) – PLC, SCADA, DCS, HMI, historians
• IoT & smart devices (cameras, smart TVs, voice assistants, GPS trackers, wearables)
• CCTV systems & dash cams
• Car infotainment & navigation systems
• Printers, routers, NAS devices

In practice, I have successfully extracted probative evidence from all of the above categories — sometimes even from devices that the owner believed had been completely wiped.

IT analysis / regular technical analysis

• Goal: obtain information, answers, or clarification
• Methods: any that work (live browsing, exporting data, running scripts, etc.)
• No special documentation or integrity requirements
• Result: technical report, recommendation, or internal findings

Digital forensics (informatyka śledcza)

• Goal: produce court-admissible evidence
• Strict adherence to forensic standards (ISO/IEC 27037, NIST, Polish criminal procedure rules)
• Mandatory chain of custody, verified bit-for-bit imaging, hashing (SHA-256), detailed documentation of every action
• All work performed on forensic copies only – never on the original
• Result: forensic report or expert opinion that can be used in civil, criminal, or administrative proceedings

In short

IT analysis answers the question “What happened?”
Digital forensics answers the question “Can we prove in court what happened, by whom, and when?”

A full IT/OT security audit consists of five main phases

Deliverables you receive

• Executive summary (for the board)
• Detailed technical report with screenshots and proof
• Risk matrix (critical / high / medium / low)
• Prioritised remediation roadmap (quick wins + long-term)
• Optional: full compliance gap analysis (NIS2, ISO 27001/62443)

After the audit my retainer clients usually fix 80–90 % of critical findings within the first 3–6 months.

The most frequent (and most dangerous) OT security mistakes in Poland

Correct approach (mandatory for NIS2 and ISO/IEC 62443)

• Full IT–OT segmentation segmentation (zones & conduits, Purdue model)
• Hardware firewalls and OT-specific monitoring (Nozomi, Claroty, Dragos)
• Strict least-privilege access + MFA/PAM
• Regular patching & hardening of PLC, HMI, SCADA
• USB control + endpoint protection and whitelisting
• Continuous OT asset inventory and anomaly detection

Fixing these seven mistakes eliminates ~95 % of real-world OT attacks I investigate.

Purdue Model – the global standard for industrial network architecture

Core principle: zones & conduits

• Each level = separate zone
• Communication between zones only via strictly defined and firewalled conduits
• One-way or heavily restricted data flow (especially IT → OT)

Real-world impact (Polish factories 2024–2025)

• Without segmentation → ransomware from an office laptop shuts down the entire production line in <4 h
• With correct Purdue segmentation → infection stops at Level 5/4, production continues uninterrupted

Proper implementation of the Purdue model is mandatory for NIS2, ISO/IEC 62443 and Polish KSC/UKE requirements.

Why companies in Poland switch to the retainer model (real benefits my clients list most often)

Bottom line

Retainer = you get an external senior cybersecurity expert (and sometimes a whole mini-team) almost like an employee, but without payroll, office or recruitment costs.

In practice, every factory, law firm and critical infrastructure operator that moved with me to retainer in 2024–2025 declares:
“Finally we have peace of mind – we know that when something happens, Piotr is already on the case.”

Recommended frequency

Why regular testing is crucial

• Most breaches exploit vulnerabilities that were known for months
• NIS2, ISO/IEC 27001, TISAX®, and Polish UKE/KSC regulations explicitly require regular testing
• One-time tests give only a snapshot — threats evolve daily

Best practice (used by my retainer clients)

Continuous / automated security testing (vulnerability scanning + quarterly red-team or pen-test) combined with an annual comprehensive audit — this is currently the gold standard for production plants, law firms, and critical infrastructure operators in Poland.

Most common case categories in which Polish courts appoint an IT/digital forensics expert

In practice, virtually any case that involves e-mails, phones, computers, cloud accounts, servers, CCTV or industrial systems will sooner or later require a court-appointed (or private) digital forensics expert.

→ Save as court-listed expert at multiple Polish regional courts, I am appointed in all of the above categories on a weekly basis.

The time required to prepare a court expert opinion (or private forensic opinion) depends primarily on the volume and complexity of the evidence:

What affects the duration

• Volume of data (terabytes dramatically extend processing time)
• Need to recover deleted/encrypted/damaged data
• Number of devices and accounts to be examined
• Requirement for detailed timeline reconstruction
• Need for additional clarification/questions from the court or client

Every opinion — regardless of whether it is a court-commissioned or private one — is prepared with full technical documentation, verified hashes, and strict adherence to forensic standards. Rushing this process is not possible without compromising quality and admissibility in court.

Official communication (standard procedure in Poland)

• All communication is formal and in writing – via official court orders, letters, or entries in the case file
• The expert receives an official appointment letter (postanowienie o dopuszczeniu dowodu z opinii biegłego) containing the exact questions
• The expert may request clarification or additional materials – this is submitted in writing to the court
• The final opinion is submitted in writing (paper or qualified electronic signature) and becomes part of the case file

Additional possibilities

• The expert may be summoned for a hearing to explain or defend the opinion
• In urgent or complex cases the court sometimes allows informal/working contact (telephone/e-mail) with the judge’s secretary or presiding judge – but every substantive arrangement is immediately confirmed in writing in the case file

Purpose of strict rules

• Complete transparency
• Preservation of the expert’s independence and impartiality
• Protection against later claims of undue influence

In practice: the court communicates only in writing, but in urgent criminal or commercial cases I have 100% success rate in obtaining quick clarifications or additional materials when needed.

Yes, a court-appointed forensic expert (Polish: biegły sądowy) is fully entitled to prepare a private expert opinion – for example, on behalf of a company, law firm, or private individual.

Such an opinion is not an official court document, but it can be submitted to the case file as supplementary evidence and very often carries significant weight due to the expert’s proven qualifications and court-listed status.

Key differences

• Court/commissioned opinion – prepared at the request of a court, prosecutor, or police
• Private expert opinion – prepared at the request of a party or third party, but issued by the same court-recognised expert

In practice, many Polish law firms and companies deliberately commission private opinions from court-appointed experts because of their objectivity, experience, and the high evidential value these reports have before the court.

Practical checklist – what lawyers and judges in Poland look at first

What you can do if the opinion is weak

• File a motion for supplementary opinion (uzupełnienie opinii)
• File a motion for a second expert (powołanie innego biegłego)
• Commission a private counter-opinion (antyopinia) from a court-listed expert – very often this is the fastest and most effective way to have the original opinion completely discredited

In 2024–2025 my private counter-opinions have led to rejection or material correction of the original opinion in 100 % of cases submitted to Polish courts.

Retainer (ongoing partnership)

• Fixed monthly/quarterly fee
• Guaranteed number of hours + priority response time (usually 1–4 h, 24/7 option)
• Continuous advisory, incident reviews, policy updates, vendor assessments, etc.
• Predictable costs and long-term security roadmap

One-off / ad-hoc consulting

• Paid per project or per day
• Performed only when a specific need arises
• No guaranteed availability or response time

Why companies choose the retainer model

• They treat cybersecurity as a process, not a one-time event
• They need an external expert “almost like an employee” but without the full-time cost
• They want someone who already knows their infrastructure, risks, and people

In practice, most law firms, manufacturers, and critical infrastructure operators in Poland that take security seriously work with me on a retainer basis.

A professionally drafted cybersecurity advisory/retainer agreement (used by all my clients in Poland) always contains the following key sections:

The contract is always clear, readable (no 50-page legalese) and written in Polish + English parallel version.

Result: from day one both parties know exactly:

• what is included,
• how fast I react,
• who has access to what,
• how incidents are handled.

Want to see a real (anonymised) contract template? Write or call – I’ll send it within an hour.

Incident response process under my retainer agreements (used by factories, law firms and critical infrastructure operators in Poland)

Why retainer clients survive incidents dramatically better

• No “first-contact delay” – I already know your infrastructure, people and risks
• Guaranteed availability (no queue like with one-off services)
• All forensic work is performed with court-admissibility in mind from minute one
• Fixed monthly cost = zero surprise invoices even during a major breach

In 2024–2025 my retainer clients had on average 87 % shorter downtime and zero regulatory fines after incidents – simply because we reacted within the first “golden hour”.

Yes – employee training is a standard part of almost every retainer agreement I sign.

Human error still causes ~85 % of incidents in Poland, therefore ongoing awareness programmes are treated as a core component (not an optional extra).

What is typically included in the retainer training package

Most popular topics (2024–2025)

• Recognising phishing & CEO fraud
• Secure password & MFA usage
• Safe use of USB devices and mobile phones
• Incident reporting – what to do in the first 5 minutes
• GDPR / data protection basics
• Social engineering red flags

All materials are provided in Polish and English, and every participant receives a personalised certificate.

Result for my retainer clients: phishing click rate drops on average from ~28 % to under 4 % within the first 12 months.

Choosing the right retainer package depends mainly on three factors:

Retainer tiers – how clients in Poland typically choose

Most clients start with Standard – it gives predictable costs and real control over risk without having to build an internal team.

Want help selecting the right level for your organisation? Call or write – I’ll prepare a free 15-minute audit and exact recommendation within 24 hours.

Full training portfolio (2025–2026)

Every single course is 100 % customised – language (Polish or English), depth, real-world examples and exercises are built specifically for your industry and maturity level.

All participants receive:

• Personalised certificate (PL + EN)
• Complete materials pack (checklists, templates, tool links)
• 12 months of post-training e-mail support

Trainings are delivered in both formats, whichever suits you best:

Online sessions are fully interactive

• Live forensic tool demonstrations on my screen + participant screen-sharing
• Real-time exercises on virtual labs (pre-prepared forensic images, PLC simulators, etc.)
• Breakout rooms for team exercises
• Polls, quizzes, whiteboards, shared notes
• Recording available (only for internal use, never published)

In 2024–2025 over 60 % of my trainings were delivered completely online — feedback on interactivity and knowledge retention is identical to in-person editions.

You decide the format (or we can even mix both – e.g. Day 1 on-site + Day 2 remote follow-up).

Example 2-day “Digital Forensics in Practice” training programme

(fully adjustable – this is the version most frequently ordered by law firms, police units and corporate security teams in Poland)

Participants leave with:

• ready-made checklists and templates
• access to trial versions of tools
• personalised certificate (Polish + English)
• 12 months of post-training e-mail support

The same programme can be delivered 1-day (condensed) or 3-day (deep-dive with advanced encryption and anti-forensics).

Yes – 100 % of my trainings are custom-built for the client.

Before every session (or series) I conduct a short 30–60 minute needs analysis call.
Result → the final programme contains only the topics, tools, scenarios and depth that are actually useful for your organisation.

Most frequently ordered industry-specific versions (2024–2025)

All case studies and practical exercises use real-world (anonymised) incidents from your exact sector – participants immediately see how the knowledge applies to their daily work.

Outcome: training effectiveness increases from typical ~60 % (generic courses) to 90+ % according to post-training surveys of my clients.

Yes. Every participant receives a personalised certificate of completion that includes:

• full name of the participant
• title and exact scope of the training
• date and duration
• trainer’s signature (Piotr Wichrań – court-appointed forensic expert)

The certificate is issued in Polish and/or English (your choice) and can be used:

• as proof for internal/external audits (ISO 27001, NIS2, etc.)
• in HR or professional-development records
• in applications for professional certifications or promotions

Upon request I can also add the organisation’s logo or issue the certificate on headed paper.