Use case
Anton Piller order execution: forensic support.
A civil search order is no use without a defensible record of what was found. We image on-site, preserve under chain of custody, and produce an examiner affidavit the court can rely on.
Signs you may need this
Common indicators we hear from counsel and corporate clients.
- Counsel obtained or is seeking an Anton Piller order
- Risk of evidence destruction at a target premises
- Multiple devices and locations to image quickly
- Court-supervised forensic capture required
- Need for examiner available to attest to process
How we approach it
A defensible, repeatable process.
1. Pre-execution scoping. We coordinate with counsel and the supervising solicitor on the scope of the order, the devices and accounts likely to contain the evidence, and the equipment we will bring. We prepare the imaging hardware, sterile target media, and evidence-bag inventory in advance.
2. On-site imaging. We arrive with counsel and the supervising solicitor. Each device within the order's scope is imaged with a hardware write-blocker or forensic acquisition tool. Hash values are recorded on-site. Evidence bags are sealed in front of the supervising solicitor.
3. Chain of custody. Every device, every image, every transport step is documented with timestamps and signatures. The chain runs from the moment we make contact with the device through return to our Langley main office and into the eventual archive.
4. Examiner affidavit. After the execution, we prepare a sworn examiner affidavit describing what was imaged, the methodology, the hash verification, and the chain of custody. This affidavit is filed in support of subsequent applications.
5. Preservation pending order. Until the court rules on the next steps, the imaged evidence remains in our custody under documented retention. No analysis is performed until counsel and the court permit it.
What we deliver
Concrete outputs from a typical engagement.
- 01
Pre-execution scoping and equipment plan
- 02
On-site forensic imaging of devices and accounts
- 03
Real-time inventory and chain-of-custody log
- 04
Sealed forensic images delivered to supervising solicitor
- 05
Affidavit of examiner detailing process
- Forensic images of every in-scope device, hash-verified.
- A written log of the on-site execution, signed by the examiner and the supervising solicitor.
- An examiner affidavit suitable for filing in the BC Supreme Court or Federal Court.
- A documented chain of custody from acquisition through return.
- Sealed and archived evidence held pending the court's directions.
Services typically engaged
Forensic services we draw on for this scenario.
Computer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Learn moreMobile Forensics
iOS and Android extraction including chip-off, JTAG, and ISP techniques for damaged or locked devices that conventional tools cannot read.
Learn moreCloud Forensics
Defensible collection and analysis of Microsoft 365, Google Workspace, AWS, Slack, Teams, and Salesforce evidence under legal hold.
Learn moreExpert Witness
Court-qualified expert witnesses delivering affidavits, expert reports, and trial testimony in Canadian civil and criminal matters.
Learn moreCommon questions
Anton Piller Orders questions we hear most.
Do you have on-site imaging equipment ready to deploy?
Yes. We maintain a full Anton Piller kit with hardware write-blockers, sterile target drives, evidence bags, and imaging hardware. We can deploy on short notice across the Lower Mainland and on a longer notice elsewhere in BC and Canada.
How fast can you scope an Anton Piller execution?
Within hours when the matter is urgent. We have moved on Anton Piller engagements within 48 hours of initial counsel contact.
Who drafts the order and supervises the execution?
That is counsel's role and the supervising solicitor's role. We are the forensic technical arm. The legal architecture and supervision is built by counsel.
Can you image cloud accounts as well as devices?
Yes, when the order's scope reaches them. Cloud collection is typically completed in parallel with on-site device imaging.
Do you preserve evidence until the court rules?
Yes. Imaged evidence is held in our custody under documented retention until counsel and the court permit analysis or release.
Related scenarios
Other use cases that often arise alongside this one.
IP & Trade Secret Theft
Source code, formulas, and proprietary data theft investigations with court-ready reports.
ExploreEmployee Data Theft
Departing-employee data theft: USB, cloud upload, and email exfiltration forensics.
ExploreLitigation Hold
Defensible preservation of devices, mailboxes, and cloud accounts once litigation is anticipated.
ExploreHave an Anton Piller execution coming up?
Tell us the date, the location, and the scope. Our team will reach out as soon as possible.