Discovery & Digital Forensics

Connecting the dots for your investigation

Deloitte understands that our clients face many different types of discovery and digital forensic matters. To help them address these potential challenges, our Discovery and Digital Forensics practice offers a full range of services across the forensic, discovery, and investigative lifecycles.

Deloitte Discovery & Digital Forensics

Our Services

Litigation Support

A key component of litigation is the Discovery process, whereby each party provides relevant evidence to other parties in the litigation. Traditional discovery presents a risk to litigants, and, if inadequately managed, may have a significant effect on the success and cost of the litigation. Electronic Discovery however presents an opportunity for litigants to maximise their informational, evidential and strategic advantage. Deloitte Discovery services were designed to manage volumes of data during investigations - whether the data is already available in electronic format or in hard copy - as well as efficiently managing all technical aspects. Our Discovery services include forensic collection, handling, retention and analysis of data with specialised tools and methodologies in order to find information and evidence relevant to the investigation. Discovery services can be tailored to the specific needs of each litigation investigation by including only those specific phases of interest.

Data Collection

Deloitte offers data collection services across a wide range of data sources and devices. Our teams use industry standard forensic software and hardware to improve drive acquisition speed, and multiple options for write blocking to help maintain the integrity and authenticity of data of each collection. Our professionals follow industry standard chain of custody (CoC) guidelines. The collection methodologies and CoC documentation are designed to meet requirements for court acceptance.


eDiscovery (Electronic Discovery) procedures are required to address regulatory authority investigations or global risks including local and cross-border disputes or international litigations. eDiscovery follows the Electronic Discovery Reference Model (EDRM), utilizing the appropriate language(s) and software. This often requires the processing of high volumes of data at a time, and requires special expertise to ensure an effective investigation.

Document Review

Deloitte’s Document Review professionals offer companies and their legal counsel efficient and timely assistance with document review and production in complex business disputes and investigations, including handling matters of relevance, privilege and categorization of issues. They also leverage technology and advanced analytics techniques, such as text categorization, to help create efficiencies and cost savings, protect privilege, conceal trade secrets, and comply with privacy requirements.

Expert Witness

Deloitte has a large-scale in professional experience for providing Expert Witness Service as part of litigation or disputes resolution in all types of disputes and industries. Law firms could use our expert witness service to evaluate the quantum of a particular claim and also to provide evidence in cases on liability involving alleged or audit neglect. Expert Witness professionals of our organisation are effective during the stages of a dispute, from counselling clients in the introductory phases to deliver expert valid evidence which could be used for a court of Tribunal.

Digital Forensics

Deloitte supports computer forensic-based digital investigations in a variety of fraud cases including information leakage, cyber-attack, malware incident, unauthorized access, fraudulent accounting, etc. Digital Forensics involves the securing, documentation and analysis of digital evidence from electronic devices and networks that if required can be produced in Court. This includes hard drives (from laptops, PCs, servers etc), mobile devices, fax and printing machines and network traffic – in short, all digitally-stored data.

Data Recovery

Using the array of technology featured in our local and the worldwide network of computer forensics labs, our forensic professionals can recover a wealth of information from computer hard drives and many other media types, including active, deleted, hidden, lost or low-encrypted files, file fragments and even files that were merely viewed but never saved (memory forensics).

Mobile Devices Forensics

Deloitte brings significant experience to support mobile device management and eDiscovery solutions. In particular, we have helped many companies navigate large mobile device litigation holds, assisted with creating appropriate discovery work flows, preserved hundreds of mobile devices, provided forensic analysis and reporting of devices, performed data extraction and produced mobile device data into standard review formats. Our focus is not only on collection of the mobile device, but also collecting and integrating the cellular provider records into the matter.

Cloud Forensics

We can assist your organization by identifying and preserving data created and stored in the cloud. We work with your team to avoid disrupting active user accounts by utilizing a propriety and scalable cloud collection infrastructure. Combined with our defensible processes, we can help convert collected data into standard industry formats needed for traditional processing and review and further forensic analysis.

Incident Response & Crisis Management

The increase of cybercrime and data breaches continue to pose major problems for organizations in today’s digital world. While adversaries can create service disruptions through cyber-attacks, the most advanced methods of penetrations and breaches are specifically designed to remain undetected on your network as they collect and capture valuable data. Deloitte helps organizations with incident response and crisis management in their information environments to protect their important data as well as their reputations and operations. Our Incident Response and Crisis Management practice delivers timely and actionable information as a data breach investigation unfolds so that you can make business and system protection decisions, and understand the adversaries’ motives and the data they seek. Our professionals understand the uncertainties, risks, challenges and opportunities in the operating environments of large, complex organizations. Coupled with our industry experience we can deliver services, perspectives and solutions that best suit you, your business, your goals and, most importantly, your data.

Incident / Crisis Simulations and War Gaming

Many organizations devote substantial time and resources to risk management. But there’s a place where the predictable gives way to the unpredictable - and a risk, or combination of risks, turn into a crisis. Deloitte can help your organization identify potential crises and prepare leadership, through advanced immersive training techniques, to manage a crisis. The simulation helps lay a solid foundation for everything that follows. Theoretical threats become more real and vivid. Potential risks are more tangible. And people walk away with a greater understanding of the roles they’ll play when the stakes are highest. Our approach leverages experience and innovation, applied to advanced methods of crisis simulation designed to help you understand what needs to happen during different kinds of crises, and whether your organization is prepared.

Readiness Consulting

Preparing for the inevitable incident involves more than preparing to react — to merely neutralize a ones-off incident. It involves the ability to respond effectively and repeatedly —to plan proactively, to defend your critical assets vigorously, to get ahead of evolving threats, and to recover thoroughly when real incident do occur. As cyber-attacks and other fraudulent actions increasingly take a toll on corporate bottom lines and reputations, developing a strong incident response, discovery and forensic capabilities becomes essential for businesses that seek to build secure, vigilant, resilient organizations. The threats and complexities of fraud and cybercrime are urgent. Deloitte proactively helps its clients to develop Incident Response, Discovery and Forensic Data Readiness capabilities so they can be ready to handle a crisis in order to emerge stronger.

Malware Analysis

Malware stands for malicious software, scripts or code meant to aid an attacker to hack a system, keep control, and steal information or to cause damage. Malware poses a large risk to an organization. At Deloitte’s Forensic Malware Analysis lab, malicious software is analyzed through a root-cause oriented approach (once collected using forensically sound techniques from the organisation’s environment). Via analysing the malware using our forensic tools we can help assess whether other malware may have been also installed that could compromise the corporate systems, or whether other systems may have been similarly affected. Malware analysis is a significant ingredient of our Digital Forensics and Incident Response Services.


Our Discovery team uses a dedicated computer forensic laboratory infrastructure as well as specialized forensic software tools and field kits for national and international data collections. The hardware and software used by our team ensures an efficient and trusted methodology for performing all the required tasks at each stage of the Electronic Discovery Reference Model (EDRM). The laboratory has physically secured work area and allows for separate forensic computer processing systems, which are not connected to the Deloitte corporate computer network.

Data privacy and security

As a member of the European Union, Cyprus has implemented the Processing of Personal Data (Protection of the Individual) Law, to abide with the EU Directive 95/46 on the protection of individuals with regards to the processing of personal data. Cyprus, as an EU member state, will adhere and implement the equivalent legislation that will be aligned to the EU’s General Data Protection Regulation (GDPR) which was approved in April, 2016. Our team of Data Privacy and Cyber Risk specialists work closely with our Discovery and Digital Forensics team in advising clients and addressing issues pertaining to data privacy laws and regulation in Cyprus and on how these laws affect data collection, processing, analysis and review.

Deloitte Difference

Forensic specialists. Our diverse team bring specialized technical and business knowledge. We have witnesses that have testified in court, arbitration, regulatory, and other proceedings globally. Our experienced teams of forensic specialists have extensive technical and investigative knowledge and we have a global network of over 3000 forensic and financial crime professionals in 50 countries to assist with investigations. We bring value to our clients across numerous technical areas including forensic investigations mobile device discovery and examinations, expert witness services and cyber incident response.

Industry-focused. Deloitte leverages in-depth knowledge of industry sectors based on years of experience working closely with our clients.

Local & Global reach.
Our local team has extensive experience in local as well as global forensic engagements, and is equipped with latest technology tools, methodologies and procedures. We are also able to draw from the experience of 200,000 professionals within the network of the Deloitte Touche Tohmatsu Limited member firms and their affiliates. This access enables us to address a wide range of cross-border issues impacting people, process and technology.

Key Contact

Panicos G. Papamichael

Panicos G. Papamichael

Risk Advisory Partner

Panicos is a Risk Advisory Partner with a focus on Strategy & Operations, Enterprise Applications and Technology Integration Consulting functions of the Firm and contributes to the development of the ... More