What Forensic IT does

Forensic IT is an Australia-based digital forensics and cyber incident response (DFIR) specialist firm, operating as a wholly-owned subsidiary of Infotrust (ASX:ITS) following its 2024 acquisition. Founded in 2013 by David Caldwell, a former Officer in Charge of the Victoria Police Computer Crime Squad, the company delivers expert digital evidence collection, forensic analysis, eDiscovery, expert witness testimony, and rapid cyber incident response to law firms, corporate enterprises, Australian government agencies, and insolvency practitioners. Core services span cyber incident response (including a 2-hour triage retainer SLA and 24/7 coverage), digital forensics (mobile device extraction via Cellebrite UFED, forensic analysis via Magnet Axiom, endpoint investigation via Crowdstrike Falcon), and litigation support (EDT and RelativityOne platforms), with additional offerings in Industrial Control Systems security assessments, insolvency data preservation, and legacy digital estate services. Headquartered in Sydney with a regional presence in Queensland and operational origins in Melbourne, Forensic IT is led by Executive General Manager Christopher Hatfield (joined March 2026 from FTI Consulting) alongside founder David Caldwell as Director, with Principal Consultants Jordan Hunt (Incident Response) and Brendan McCreesh (Digital Forensics), and Senior Analyst Josh Kither.

Forensic IT generates revenue through a mix of professional services engagements billed on hourly or fixed-fee project terms, recurring cyber security retainer contracts with monthly billing and a 2-hour standard response SLA, and eDiscovery platform usage fees. The go-to-market is a B2B sales-led motion targeting legal, corporate, and government decision-makers, delivered through direct engagement, industry referrals, and relationship-based business development, with distribution leverage from Infotrust's 200+ cyber specialist national team and 24/7 Australian-based Security Operations Centre. Service areas include IT and OT networks, cloud environments (including Microsoft 365), mobile devices, and live-running servers, with forensically sound acquisition methods that preserve chain of custody and metadata for court admissibility.

Name

Forensic IT

Legal name

Forensic IT Pty Ltd

Website

https://forensicit.com.au

Company type

Private

Founded year

2013

Operating status

Operating

Headcount range

11–50 employees

Short description

Forensic IT is an Australia-based digital forensics and cyber incident response firm, wholly owned by Infotrust (ASX:ITS), serving law firms, corporates, government agencies, and insolvency practitioners with expert evidence collection, eDiscovery, expert testimony, and rapid cyber incident response.

Ownership category

akta.pro rank

Product category

Digital Forensics and Incident Response Services

NAICS

Investigation and Personal Background Check Services (561611), Investigation and Security Services (5616)

SIC

Services-Detective, Guard & Armored Car Services (7381)

akta.pro primary industry

Digital Forensics & Evidence Collection (Endpoint, Mobile, Cloud) (BPAKAHAC)

akta.pro secondary industries

eDiscovery, Litigation Support & Expert Witness Services (BPAKAHAD), Fraud, Cybercrime Investigations & Brand/Dark Web Monitoring (BPAKAHAO)

Keywords

• Digital forensics services
• Cyber incident response
• EDiscovery services
• Mobile device forensics
• Forensic investigations

Headquarters

HQ city

Melbourne

HQ country

Australia

HQ region

Oceania

Offices3 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Professional Services - Digital Forensics: Billable professional services engagements for digital forensic investigations, evidence collection, analysis, and expert witness testimony. Revenue generated through hourly consulting rates or fixed project fees for engagements including search warrants, Anton Piller orders, IP theft investigations, and employee misconduct cases.
2. Cyber Incident Response Services: Rapid incident response engagements for ransomware, data breaches, and cyber attacks. Revenue from emergency response engagements, incident investigation, and remediation services. Includes interim and comprehensive reporting for legal and compliance purposes.
3. Cyber Security Retainer Contracts: Recurring retainer contracts providing pre-arranged incident response capability with standard 2-hour triage response SLA. Retainer includes unlimited 24x7 triage advice, onboarding workshops, and regular threat landscape updates. Low base retainer with additional services as needed.
4. eDiscovery and Litigation Support: Document review platform services including collection, early case assessment, processing, de-duplication, searching, review, and legal export. Revenue from platform usage fees and professional services for electronic discovery in legal matters.
5. ICS Security Assessments: Industrial Control System IT security assessments providing network architecture evaluation, system configuration review, security protocol assessment, and simulation testing. Billed as consulting engagements with detailed findings reports.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels7 records

Core offering

Forensic IT delivers digital forensics investigations and cyber incident response services across Australia, supporting law firms, corporate enterprises, government agencies, and insolvency practitioners. Service scope covers mobile device extraction, eDiscovery and litigation support, expert witness testimony, covert data acquisition, ransomware and phishing investigations, ICS security assessments, and cyber security retainer contracts with a 2-hour triage response SLA.

Product overview

Forensic IT is a digital forensics and cyber incident response service provider operating as part of Infotrust (ASX:ITS), Australia's leading cyber security and technology services provider. The company offers an integrated suite of services spanning two core areas: Cyber Incident Response (including rapid triage, 24/7 coverage, and security retainer services) and Digital Forensics (encompassing mobile device extraction, eDiscovery, expert testimony, and specialist investigations). Services are delivered by a team with law enforcement and corporate forensic backgrounds, supporting IT and OT networks for legal professionals, corporate clients, and government agencies across Australia. The company also provides sector-specific offerings including Industrial Control Systems security assessments, insolvency industry services, and legacy digital estate access services.

Differentiator

Problem solved

Functional benefit

Products and services

• Cyber Incident Response Rapid incident response services for IT and OT networks including triage with 2-hour standard response time, damage containment, evidence preservation, system restoration, and 24/7 cyber security retainer options for enterprise clients.
• Digital Forensics Identification, collection, preservation, and analysis of electronic evidence for investigations, court cases, and business requirements using best-practice forensic methodology.
• Fraud and Financial Investigations Forensic investigation services for corporate fraud and financial crime, securing electronically stored information from computers, servers, phones, and accounting systems.
• Mobile Device Extraction and Analysis Physical, logical, and file system extraction of data from mobile phones, smartphones, tablets, and GPS devices including recovery of deleted data using Cellebrite UFED technology.
• Search Orders (Anton Piller) Specialist civil search order services for preservation of digital evidence particularly relating to intellectual property theft, including preparation, application, and execution support.
• Expert Testimony Expert witness services presenting digital evidence in court in a legally acceptable manner with clear explanations, visual representations, and virtualised computer environments.
• eDiscovery and Litigation Support Collection, early case assessment, processing, de-duplication, searching, review, and legal export of electronically stored information using EDT and RelativityOne platforms.
• Covert Data Acquisition Covert collection of data from computers and servers without end-user knowledge or disruption to business applications, available outside normal business hours.
• Industrial Control Systems (ICS) Security Assessments Comprehensive IT security assessments for industrial control systems across multiple sectors using manual analysis and specialised tools to identify vulnerabilities and recommend mitigation strategies.
• Search Warrants Support Assistance to government agencies in execution of search warrants including field management, coordination, triage, and forensic acquisition of desktop computers, servers, and mobile devices.
• Insolvency Industry Services Day 1 business system assessments and data collection services for administrators and liquidators, including forensic imaging, mobile phone extraction, cloud data downloading, Microsoft 365 collection, and accounting system extraction.
• Legacy Contacts and Digital Estate Services Access to deceased persons' devices, accounts, and digital content for next of kin, including support for social media memorialisation, Apple ID legacy contacts, and digital estate planning.
• Office 365 Email Security Assessment Security reviews for cloud-based Office 365 implementations to identify vulnerabilities, external account compromise, and forwarding rule exploitation risks.
• Theft of Intellectual Property Investigation Investigation of departing employees taking confidential business information through email, removable media, or cloud accounts, including identification, quantification, and evidence preservation.
• Ransomware/Cryptolocker Investigation Investigation of ransomware attacks including identification of compromise timeline, data access assessment, and evaluation of business and IT response effectiveness.
• Spear Phishing Investigation Investigation of sophisticated phishing attacks involving domain spoofing and impersonation of company executives to extract financial payments.
• Business Solvency and Administration Services Capture of books and records when administrators or liquidators are appointed, including electronically stored information from accounting systems, email, and hosted service providers.
• Falsification of Documents Analysis Investigation of document authenticity through forensic analysis of electronic devices and metadata examination to confirm creation or modification dates.
• Transactional Inquiries Support for government regulator inquiries involving identification of electronic data repositories, collection and processing of data, and document discovery using eDiscovery platforms.
• Employee Fraud Investigation Investigation of employee theft including covert collection of accounting records and email, evidence preservation, and brief of evidence preparation for law enforcement.
• Cyber Security Retainer Contracts

Quantifiable outcome

• 2-hour standard triage response time under retainer agreements
• +2 more outcomes

Named customers4 records

Segments5 records

Ideal customer profiles5 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration7 records

Feature5 records

Partnerships

Five partnerships are on record, tiered core and minor.

• Infotrust (ASX:ITS)coreStrategic or Co-development Partner · 1 January 2024Forensic IT was acquired by Infotrust in 2024, becoming the digital forensics and incident response segment of Infotrust. Infotrust is Australia's leading cyber security and technology services provider with 200+ cyber specialists nationwide. The acquisition enhanced Forensic IT's capabilities by integrating with Infotrust's 24/7 Australian-based Security Operations Centre (SOC), providing round-the-clock monitoring, threat detection, and rapid incident response. Infotrust's Managing Director and Group CEO Julian Challingsworth leads the combined organisation.
• CellebritecoreTechnology or IntegrationCellebrite UFED is the primary mobile device examination tool used by Forensic IT's digital forensics team. The partnership enables physical, logical, and file system extractions from mobile phones, smartphones, tablets, and GPS devices. Cellebrite is a global leader in extraction and analysis of data from mobile devices, supporting deleted data recovery including call logs, text messages, and SIM/memory card data.
• Australian Cyber Security Centre (ACSC)minorStrategic or Co-development PartnerForensic IT is a partner in the ACSC Partnership Program, collaborating with the Australian government's cyber security initiative under the Department of Home Affairs. This partnership supports information sharing on cyber threats and coordinated incident response.
• EDT (Evidence and Case Management Platform)coreTechnology or IntegrationEDT is the online document review and eDiscovery platform used by Forensic IT for litigation support. The platform provides remote document access, parallel processing, OCR integration, and comprehensive file type support. Forensic IT can control EDT pricing to make it cost-effective for clients.
• RelativityOnecoreTechnology or IntegrationRelativityOne is an alternative eDiscovery and document review platform available from 2026, providing all-in-one legal technology capabilities. Forensic IT offers this as a secondary platform option for document review and litigation support.

Scale indicators6 records

Recent moves7 records

Expansion highlights6 records

Broad incumbents

• Mandiant (Google Cloud): Global incident response and cyber threat intelligence leader, now part of Google Cloud, providing DFIR, compromise assessments, and expert testimony worldwide. Directly comparable as a high-end DFIR competitor targeting similar enterprise and government buyers.
• FTI Consulting: Global advisory firm with a large Forensic Technology and eDiscovery practice offering digital forensics, incident response, and expert witness services across multi-jurisdictional matters. Directly comparable because Forensic IT's new EGM Christopher Hatfield joined from FTI Consulting as Managing Director in that practice.
• CrowdStrike Services: Endpoint security leader with an incident response and proactive services practice leveraging the Falcon platform. Comparable because Forensic IT already uses CrowdStrike Falcon in its IR toolkit, and CrowdStrike Services competes for similar DFIR retainers and breach response work.
• Ankura: Global advisory firm with a Data & Technology practice offering digital forensics, incident response, and eDiscovery services. Comparable as a mid-to-large alternative competing for similar mandates, including complex multi-jurisdictional matters.
• PwC (Forensic Services): Big 4 firm providing forensic technology, eDiscovery, cyber incident response, and expert witness services globally. Comparable as a direct competitor for complex investigations and regulatory engagements.
• Kroll: Global risk and financial advisory firm with a dedicated Cyber Risk practice offering digital forensics, incident response, litigation support, and expert witness services. Comparable as a multidisciplinary competitor addressing the same law firm, corporate, and government segments.
• Deloitte (Cyber Risk Services): Big 4 firm with a global Cyber Risk and Forensic practice offering incident response, digital forensics, eDiscovery, and expert testimony. Comparable as a large-scale DFIR competitor for enterprise and government mandates in Australia and the broader APAC region.
• KPMG (Forensic Technology): Big 4 firm with a Forensic Technology services practice covering digital forensics, incident response, and eDiscovery for legal and regulatory matters. Comparable as another full-service alternative pursuing similar Australian enterprise, government, and law firm work.

Emerging players

• Sententia Consulting: Australian digital forensics and incident response specialist serving legal, corporate, and government clients. Comparable as a domestic boutique DFIR competitor with overlapping service lines and customer segments.

Regional players

• Nuix: Australian-headquartered investigative analytics and eDiscovery software provider with associated services. Comparable as a fellow Australian-headquartered DFIR-adjacent firm serving legal, regulatory, and corporate investigation use cases.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks1 record

Key highlights6 records

Customer concentration

• Xx.com/forensicitpl
• LinkedInlinkedin.com/company/about

Revenue estimate

Valuation estimate

Number of profiles

Profiles5 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Forensic IT