Zeno is preparing the intake forms, custody records, report controls and retention terms described on this page. Until they are approved, this is the intended sequence rather than a live procedure or contractual commitment.
Zeno Forensics begins with consent-based Android and iOS examinations. The exact method depends on the device, operating system, state, available access, applications and agreed scope. No website form accepts evidence uploads, device images or credentials.
1. Confirm documented consent
Before accepting an examination, establish who owns or controls the device and what the documented consent permits. The engagement must identify the device or devices, the person or organisation giving permission, the examination purpose and the people permitted to instruct and receive work product.
If the consent position is unclear, the work does not proceed as a launch examination.
2. Define the scope
Agree the question to be answered, relevant time period, sources in scope, intended output and any constraints on collection or review. A narrow scope is not a weaker one. It makes the examination proportionate and tells the reader what an answer can, and cannot, address.
At this stage, record likely technical limits: device model, operating-system version, device condition, available credentials, application state and the acquisition methods that may be available.
3. Receive and acquire
Record the device or source as received, its identifiers, visible condition and the transfer details. Where an acquisition is appropriate, use the agreed method and preserve the associated acquisition record. A verified working copy may be used for examination while the original source is preserved according to the engagement terms.
The evidence manifest should identify the received material, produced artifacts, relevant hashes and handling events needed to trace the work.
4. Analyse and validate
Review the acquired material against the agreed question. Analysis may include relevant communications, timelines, application activity, locations, media or files where they are available and within scope.
Findings are checked against the source artifacts and the known limits of the method. An artifact can be useful without answering every question. The report should say when the available data does not support a conclusion.
5. Report and hand over
The work product should make it possible for the instructing team to understand what was done and to review the basis for the answer. It distinguishes evidence references, findings, interpretation and limitations. Handover recipients and the method of transfer are agreed before delivery.
Zeno does not guarantee legal admissibility. That depends on the matter, jurisdiction, consent, handling and the assessment of the relevant forum.
6. Retain, return or delete
At the outset, agree what happens to the device, working material and report after handover. The engagement should state the retention period, permitted access, return process, deletion method and any hold that overrides routine deletion.
When the agreed retention period ends and no hold applies, return or securely delete the material in line with the engagement record. The disposition should be recorded.
What can change the process
Device access and output are not guaranteed. A device may be unsupported by an available method, damaged, locked, missing the necessary access, encrypted in a way that cannot be examined within consent, or unable to yield relevant artifacts. These facts are assessed before and during the work, not hidden at the end.
Zeno does not provide unauthorised access, universal unlocking or an automatic route to admissibility. If the engagement requires a method or environment outside the launch scope, we will not represent it as available.
Questions we expect
Can we send the evidence through this website?
No. Use the contact form only to describe the requirement. Evidence transfer and access details are arranged only after the engagement path is agreed.
Can you examine a seized device?
No. Zeno does not examine seized devices or case property at launch. For a consented examination, lock state and available credentials are feasibility inputs.
Where will the evidence be processed and stored?
That is defined per engagement before work begins. The location, access, retention, handover and deletion arrangements must be documented rather than assumed.
Will the report decide the legal outcome?
No. It records the work performed, the evidence references, findings and limitations. Legal significance and admissibility remain matter- and jurisdiction-specific.
Start with the facts that define the work
When you contact Zeno, describe the matter, the consent position, device type, question to be answered, relevant period and required work product. Do not send the underlying evidence until a suitable engagement and transfer route are in place.