whitehat4u recovers, preserves and explains digital evidence from phones, computers and storage media. We work from Kraków for courts, law firms, investigators and private clients in Poland, Spain, Norway and across Europe.
Phone numbers, accounts, emails, IP addresses and payments are entities. Each link between them must point to a piece of evidence. Laid out as a graph, patterns appear: one phone behind many accounts, one wallet behind many victims.
Example case with fictional data. Every line must point to evidence a court can check, in the order it happened. Touch or hover a circle to light it up:
100,000+
incidents handled by CERT Polska in 2024, almost 300 a day. Phishing was the most common.
Source97,348
incidents handled by INCIBE in 2024. Two thirds affected private citizens, and 43% were online fraud.
SourceNOK 607M
lost to payment fraud in Norway in the first half of 2024, 16% more than in the previous six months.
Source4,875
incidents analysed by ENISA, the EU cybersecurity agency, between July 2024 and June 2025.
SourceCourts, prosecutors, law firms
Analysis of seized devices and written expert opinions for proceedings, or a private expert opinion for one party. Findings are explained in plain language and defended in testimony.
Police units, investigators
Acquisition and analysis support when caseloads exceed in-house capacity: phone and computer extraction, timeline reconstruction and documented chain of custody.
Individuals and families
For people who have been scammed, harassed or threatened online and don't know where to start. We secure what is on your devices, trace what we can, and prepare a report you can take to the police or a lawyer.
Companies and institutions
Investigation of data leaks, insider misuse and compromised accounts, with evidence preserved so it can be used later in court or for an insurance claim.
You describe what happened. We tell you what can realistically be recovered and what it will cost before anything starts.
Devices are copied bit for bit behind a write blocker. The original and the copy are hashed so anyone can verify nothing changed.
SHA-256 original = SHA-256 copy
We work only on verified copies, with open, peer-reviewed Linux tools whose results can be reproduced by another expert.
A clear report with every finding traceable to its source, and testimony to explain it in court if needed.
Use the pad to browse the four forensic distributions we work with. Press OK to open one.
SIFT Workstation
SANS Institute, Ubuntu based
A complete incident response and forensics workstation. Bundles The Sleuth Kit, Plaso for super-timelines and Volatility for memory analysis.
$ log2timeline.py --storage-file case.plaso evidence.E01 CAINE
Computer Aided INvestigative Environment, Italy
A live forensic distribution that mounts every device read-only by default, so evidence can be examined on site without being modified.
$ mount -o ro,noexec,noload /dev/sdb1 /mnt/evidence Kali Linux
OffSec, Debian based
Its Forensic boot mode never touches internal disks, disables swap and stops removable media from mounting automatically.
$ sudo apt install kali-tools-forensics Tsurugi Linux
DFIR and OSINT distribution
Combines disk and memory forensics with OSINT and malware analysis tools, useful when an investigation moves from the device to the open internet.
$ fls -r -m / evidence.dd > bodyfile.txt dd reads a drive sector by sector, including deleted and unallocated space, and writes an exact copy. Forensic variants such as dc3dd hash the data while copying. The source is always connected through a write blocker.
sudo dc3dd if=/dev/sdb of=case042.dd hash=sha256 log=case042.logconv=noerror,sync keeps going past bad sectors and pads them with zeros, so offsets stay correct.
An image is a sealed copy of the evidence. Raw .dd images are simple; E01 images add compression, case metadata and embedded hashes. Matching SHA-256 values on the original and the copy prove the copy is identical.
ewfacquire /dev/sdb → ewfverify case042.E01Follows the ISO/IEC 27037 guidance for identifying, collecting and preserving digital evidence.
A USB stick is evidence in itself, and it also leaves traces on every computer it touches: vendor and product IDs, serial number, first and last connection times. On Linux these live in the system logs; on Windows in the registry.
journalctl -k | grep -i 'SerialNumber' / usbrip events historyMatching one serial number across several machines can place a device at a specific time.
Field notes, techniques and case write-ups from the lab.
You can only include packages that are already available in the official Kali repository, unless you add your own .deb files. Plus the full list of Kali forensic tools and what each one is for.
Instala logcheck, una herramienta que revisa automáticamente los archivos de log del sistema, y combínalo con tripwire para vigilar los archivos que quieres proteger.
Open tools, repeatable steps, the same result for any expert who checks. The first step of every examination is a hash. Try it.
Sample session
$ sha256sum case042.dd 9f2c4b7a01d3e8c6b5f0a4d2e7c91b38f6a0d5e2c4b1a7f9e3d8c6b2a5f0e41a case042.dd $ mmls case042.dd DOS Partition Table Units are in 512-byte sectors Slot Start End Length Description 002: 000:000 0000002048 0062521343 0062519296 Linux (0x83) $ usbrip events history -q [2026-10-02 18:41:07] connected SanDisk Ultra SN 4C5300012306 [2026-10-02 19:02:51] disconnected SanDisk Ultra SN 4C5300012306
Try it: hash a file
Pick any file. Its SHA-256 and SHA-1 are calculated on your device; the file is never uploaded.
Only the SHA-1 hash is sent to hashlookup.circl.lu, a public service run by CIRCL Luxembourg. Known files (system files, packages) can be excluded from an investigation; unknown files are what an examiner looks at first.
Call or send a message. This number is the only way to contact whitehat4u.