Computer Forensics images and analyses computers, hard drives, USB devices and email to find, recover and explain relevant activity. Send one request and independent examiners reply with availability and prices.
Say which computers or drives are involved and get computer forensics quotes.
Request a Private Investigation QuoteWhat It Involves
- Imaging. A forensic copy of the drive, verified by hash.
- File and email review. Documents, mailboxes and deleted items.
- Activity analysis. USB use, file transfers, internet history and log-ins.
- Timelines. What happened on the machine and when.
Who It Helps
Employers dealing with data theft by a departing employee, policy breaches or fraud, and attorneys who need computer evidence for a dispute.
What to Send First
- The number and type of computers or drives.
- Who owns them and who used them.
- The suspected issue and the relevant dates.
Do not upload screenshots, intimate images, passwords or documents through the request form. The investigator will tell you what to keep and how to hand it over.
How It Works
- Authority. Ownership, policy or court authority is confirmed.
- Imaging. The drive is copied without altering it.
- Analysis. The copy is searched for relevant activity.
- Report. Findings, method and evidence are documented.
Findings and Reporting
A forensic report with a timeline, relevant files and an explanation of the method, usable in disciplinary or court proceedings.
Limits
Only computers you own, or have consent or legal authority to examine, can be analysed. Employee privacy and POPIA still apply on company devices. Encrypted or wiped drives may yield little, and admissibility is for the court to decide.
Computer Forensics Prices
Ballpark prices so you can sanity-check a quotation.
| Item | Ballpark price |
|---|---|
| Laptop or desktop imaging and analysis, per device | R8,000 - R30,000 |
| External drive or USB analysis | R4,000 - R12,000 |
| Mailbox or email account review | R5,000 - R20,000 |
| Examiner hourly rate | R800 - R2,500 per hour |
| Expert testimony, per day | R8,000 - R25,000 |
Prices JUST UPDATED. Indicative ballpark figures in rand, rounded. They are compiled from prices published by South African investigation firms and typical market rates. They are not our prices or quotations, and no investigator is bound by them. Confirm VAT, travel and what each quotation includes.
Get prices for your devices rather than a range. Send one request, with no obligation.
Request a Private Investigation QuoteWhat Affects the Price
- Drive size. More data means longer imaging and searching.
- Number of devices. Each adds cost.
- Encryption. Locked drives need keys or specialist work.
- Report depth. Court-ready reports take longer.
Computer Forensics FAQs
Can you prove an employee copied company files?
Often, from USB, cloud and file access records, if the computer has not been wiped or reused.
Should we keep using the computer?
No. Switch it off or set it aside so evidence is not overwritten.
Can deleted files be recovered?
Sometimes, depending on the drive type and later use. It is not guaranteed.
Do we need the employee's consent?
For company-owned devices, your policies and the law set what is allowed. Take legal advice if unsure.
Related Services
Request computer forensics quotes through Private Investigators South Africa and compare each examiner's process, reporting and turnaround.
Private Investigators South Africa is a referral and quote service. We do not carry out investigations and we do not employ investigators. Work is quoted and carried out by independent investigators, and your agreement is with the one you choose. Ask for a written quotation and proof of PSIRA registration before you pay a deposit. No investigator can promise a particular result or that evidence will be accepted by a court.
Computer Forensics. Describe what you need once and get the best quote, fast.
Request a Private Investigation QuoteGet the Best Quote, Fast
Keep it brief. Do not send ID documents, passwords, intimate images or evidence through this form. Your enquiry is passed only to investigators suited to the job, and you decide whether to go ahead.
Client Reviews
Powered by leaderr
