Digital Investigations
We find out what really happened, and prove it
Data theft, deleted emails, altered invoices and missing money, set out so a lawyer or judge can follow it.
Learn more →Digital Forensics • Business Protection • South West WA
When files, money or messages go missing, we find out what happened and prove it.
PraetorianX is a Western Australian digital forensics team. When files are taken, emails are deleted or money goes missing, we recover and preserve the evidence for your lawyers, board or insurer, then lock down your systems so it can’t happen again.
We reply the same business day • Serving Perth and Australia-wide
Investigation timeline
Matter #PX-0000 · Excerpt
- 13 Mar
16:422,341 files synced from “Clients/Pricing” to a personal iPhoneMicrosoft 365 audit log - 13 Mar
17:05USB storage device connected to work laptopWindows device records - 14 Mar
17:30Final day. Laptop returned to ITHR record - 16 Mar
21:14Sign-in from personal device after access should have endedEntra ID sign-in log
20+ years
ICT industry experience
Same day
reply to every enquiry
Cth & WA
evidence-law standards
South West WA
serving Perth & Australia-wide
Before you do anything else
Suspect someone has taken your data? Do this first.
Don’t
- Let your IT person or anyone else “have a look” at the device
- Wipe, reset or hand the laptop or phone to someone new
- Delete their email or cloud accounts
- Confront the person or tip them off
Do
- Leave the device as it is: if it’s on, leave it on; if it’s off, leave it off
- Suspend their accounts rather than deleting them
- Write down who has handled the device, and when
- Call us. Cloud logs are only kept for a limited time
The sooner evidence is preserved, the more we can show. Read the full guide
Call 0467 697 148Where to start
Which of these sounds like you?
Pick the situation closest to yours to see what we’d do and what you’d get.
Services
Four ways we help
Whether you’re in a dispute, worried about who can get into your systems, or want a phone that respects your privacy.
Business Protection
We lock your digital doors and look after your IT
Close off old logins, secure Microsoft 365, Google Workspace and Xero, and keep watch from then on.
Learn more →Advice for Leaders
Clear technology advice for boards and lawyers
What an accounting review missed, which records to ask for, and how to meet Australian privacy obligations.
Learn more →The Praetorian Phone
A normal-feeling phone built for privacy
A Google Pixel 10 Pro running PraetorianOS, set up and ready to use. $4,200 AUD.
Learn more →How it works
Deleting something rarely erases the trail
Computers, phones and cloud systems like Microsoft 365, Google Workspace and Xero leave quiet records behind. Here’s how we turn them into answers.
Step 1
Preserve
We secure laptops, phones and cloud accounts before anything else is lost or changed.
Step 2
Analyse
We piece together who logged in, what was copied or edited, and when.
Step 3
Report
You receive a clear, dated timeline your lawyers, board or insurer can follow.
Step 4
Support
We walk your legal team through the findings and support them as the matter progresses.
Every item we collect gets a digital fingerprint (a SHA-256 hash) at the moment of collection, so anyone can later check it hasn’t changed. Our procedures are designed to meet the Evidence Act 1995 (Cth) and the Evidence Act 1906 (WA).
Case studies
How we’ve helped Australian businesses
Details are anonymised to protect our clients.
Stolen client lists
The departing manager who set up a rival
The problem: Key clients began moving to a new competitor started by former staff, who said they had taken nothing.
What we found: Cloud records showed thousands of files, including pricing and placement lists, downloaded to a personal phone before and after their final day.
✓ Dated timeline delivered to the legal team
Missing money
Finding what an accounting review missed
The problem: A business suspected hundreds of thousands of dollars in irregular insurance and supplier payments, even after a financial review.
What we found: Hidden properties in PDF certificates and bank payment files showed who created the altered documents, and matched duplicate payments to the minute.
✓ Altered documents traced to their source
Locking the doors
Protecting a board before a dispute
The problem: Directors heading into a legal dispute worried former staff or contractors could still read company email or wipe shared drives.
What we did: Preserved the evidence, closed lingering logins across Microsoft 365 and Xero, and set up private phones for confidential legal calls.
✓ Evidence preserved and old access closed
Who you’ll work with
You deal directly with the people doing the work
Shane Smith
Co-founder
Shane has more than 20 years in the ICT industry and 14 years teaching IT at certificate and diploma level. That teaching background is why our reports are written to be understood by judges, boards and business owners, not just technicians.
Chris Vigar
Co-founder
Chris co-founded PraetorianX and works alongside Shane on investigations and client engagements.
The Praetorian Phone
Works like a normal phone. Built for privacy.
A Google Pixel 10 Pro running PraetorianOS: your everyday apps, with tracking, spyware and unsafe public chargers blocked by design. Set up and ready to use for $4,200 AUD.
See the Praetorian PhoneFree 60-second check
Are your business’s digital doors locked?
Tick anything that sounds familiar.
0 ticked
Tick any that apply
Guides
Practical guides
Plain, practical answers to the questions we hear most.
Guide · 6 min read
What to do when a staff member leaves with your data
The first 48 hours matter most. What to do, what not to do, and how to protect your evidence.
Read the guide →Guide · 5 min read
How long does Microsoft 365 keep its activity logs?
The records that show who downloaded what don��t last forever. Here��s how long they��re kept, and how to keep them longer.
Read the guide →Guide · 6 min read
Digital evidence requests: a checklist for lawyers
What to ask for, in what format, and why screenshots and printouts are rarely enough.
Read the guide →FAQ
Questions people ask us
What does PraetorianX do?
PraetorianX is a Western Australian digital forensics and business IT protection firm, based in the South West (ABN 68 549 085 355). We recover and preserve digital evidence when files are taken, emails are deleted or documents are altered; lock down business systems such as Microsoft 365, Google Workspace and Xero; advise leaders and lawyers on technology; and supply the Praetorian Phone.
What should I do if I think someone has taken our data?
Don��t let anyone ��have a look�� at the device, and don��t wipe, reissue or reset it. Suspend the person��s accounts rather than deleting them, don��t confront them yet, and call us. Cloud audit logs are only kept for a limited time, so the sooner they are preserved, the more can be shown.
Can your evidence be used in Australian courts?
Evidence is only as strong as the way it was collected. We preserve it using documented forensic procedures, including a SHA-256 ��digital fingerprint�� taken at collection and a full chain-of-custody record, designed to meet the Evidence Act 1995 (Cth) and the Evidence Act 1906 (WA). Whether evidence is admitted is always a matter for the court, but our process is built so its integrity can be demonstrated.
Can you tell if a former employee copied files to a personal phone or USB drive?
In many cases, yes. Even if files were deleted or browser history was cleared, platforms such as Microsoft 365, OneDrive, SharePoint and Google Workspace keep audit trails, and computers record connected devices. We combine those records to show what was accessed or copied, and when.
Do I need to understand technology to work with you?
No. Tell us what��s happening in your own words, for example ��we think an ex-employee took our quotes folder��, and we handle the technical work and explain what we find clearly.
How are you different from IT support or an accounting audit?
IT support keeps computers running, and accountants review the financial records. We examine the digital traces underneath: cloud download logs, deleted files, hidden document authors and payment files, to establish who did what, then close the gaps so it can��t happen again.
How much is the Praetorian Phone and what��s included?
The Praetorian Phone is $4,200 AUD. It includes a new Google Pixel 10 Pro with PraetorianOS installed and set up, and a Faraday sleeve. A global travel eSIM is available for an extra $500 AUD.
Where are you based, and do you work outside the South West?
We��re based in the South West of Western Australia and work with businesses, law firms and individuals in Perth and across Australia, including Sydney and Melbourne. Much of our cloud evidence work can start remotely on the same day you contact us.
How quickly will you respond?
We reply to every enquiry the same business day. If evidence may be lost or someone still has access to your systems, call 0467 697 148 rather than waiting for an email.
How much does an investigation cost?
Every matter is different, so we quote before any work starts. Tell us what��s happening and we��ll explain the options and the cost; there��s no obligation.
No matching questions. .
Confidential • No obligation • Quotes on request
Talk to us today
Tell us what’s happening in your own words. We reply the same business day, and if evidence might be lost, call. Cloud preservation can usually start the same day.