Capabilities
Our service lines combine case review, financial and digital forensics, document integrity and international coordination under one auditable method.
Specialist disciplines with dedicated questions, deliverables and enquiry routes.
Explore specialist expertiseIndependent forensic disciplines for cases carrying very long or life sentences.
Explore ForensicsTen fictional international scenarios showing independent forensic review in practice.
Explore Case Studies →A disciplined second reading of the complete record.
We reconstruct events, statements, entities and evidentiary propositions before testing both the official theory and reasonable alternatives.
Transactions interpreted in their full commercial context.
Banking, accounting, ownership and contractual records are reconciled against authority, economic purpose, timing and corroborating evidence.
Technical evidence handled as evidence, not content.
Lawfully supplied devices and datasets are acquired, preserved and reviewed through controlled workflows with validated tools and transparent limitations.
In aviation, one missing record can change the interpretation of an entire case.
We support defence counsel, accused persons, operators, aircraft owners, lessors, insurers and authorised representatives by independently reviewing aviation evidence across technical, operational, regulatory, financial and human-factor workstreams. Our role is to test the available record and the assumptions behind existing conclusions—not to replace an aviation authority, safety investigation, regulator or qualified technical expert.
In narcotics cases, association is not proof—and movement is not knowledge.
We support defence counsel and accused persons in matters involving alleged import, export, trafficking, trade, distribution or production of controlled substances. We reconstruct the alleged role, knowledge and control of each person and independently test whether shipment records, communications, financial flows, seizure evidence and forensic conclusions support the case theory when examined as one complete record.
In arms cases, commercial proximity is not proof of knowledge, authority or criminal intent.
We support defence counsel and accused persons in matters involving alleged unlawful import, export, brokering, trade, distribution or production of weapons, ammunition or controlled components. We independently reconstruct the alleged role, knowledge, authority and effective control of each person, then test whether licensing records, end-user documentation, shipment data, communications, financial flows, seizure evidence and technical findings support the case theory when assessed as one complete record.
The gravity of a war-crimes allegation demands evidence that is complete, attributable and independently testable.
We support qualified defence counsel and accused persons in investigations and proceedings concerning alleged war crimes. Under counsel's direction, we reconstruct the relevant events, individual conduct, decision-making, knowledge, authority and effective control, then test whether witness evidence, military and administrative records, communications, imagery, open-source material and forensic findings reliably support the alleged attribution and mode of responsibility. We do not minimise alleged harm or presume any outcome; the purpose is a disciplined, source-led examination of individual criminal responsibility.
In complex financial cases, suspicion can spread across a corporate structure faster than the evidence.
We support defence counsel and accused persons in matters involving alleged fraud, bribery and corruption, money laundering, tax offences, false accounting, embezzlement, market abuse and other financial or corporate crimes. We reconstruct the transactions, governance, commercial context and decision-making, then independently test the alleged role, knowledge, intent, authority, control and benefit of each person against the complete evidential record.
Telecommunications data can look exact while remaining technically incomplete or incorrectly interpreted.
We support defence counsel and accused persons where mobile communications, subscriber records, network events or location inferences form a material part of a criminal case. We independently test the provenance, integrity and meaning of lawfully obtained telecom data, distinguish devices, SIMs, accounts and users, and examine whether infrastructure limitations, processing errors or unsupported assumptions have distorted the alleged chronology, association, movement or conduct.
An international alert should withstand independent scrutiny—not merely circulate across borders.
365 ALTERAM supports individuals and defence counsel in investigating and challenging personal data circulated through INTERPOL. We reconstruct the underlying case, test identity and factual attribution, examine the supporting judicial record and assemble a source-indexed dossier for requests seeking access, correction or deletion. Our investigative work supports a reasoned challenge; qualified counsel directs legal arguments and representation, and the competent bodies determine the outcome.
Our scope includes Red Notices and wanted-person diffusions, Blue and Green Notices, and personal data associated with Yellow, Black, Orange or Purple Notices where relevant. We also assess Silver Notice and Silver Diffusion asset-tracing records under the applicable framework, currently a pilot, and INTERPOL–UN Security Council Special Notices. These are different instruments with distinct purposes, not ascending grades of criminal guilt. Many notices are not publicly visible; absence from INTERPOL's website does not establish absence from its systems. UN sanctions-list challenges require separate procedures: a CCF request does not itself remove a UN designation.
We compare identities, aliases, dates, translations, warrants, charging documents, judgments and procedural developments against the stated allegations. The review can include financial transactions, company records, communications, location evidence and forensic reports. We document contradictions, missing context, mistaken identity, unsupported attribution and changes such as withdrawn warrants or discontinued proceedings. Every finding returns to its source; supportive, adverse and unresolved material is recorded to the same standard.
With counsel, the evidential dossier supports assessment of accuracy, purpose, proportionality and the instrument-specific conditions under INTERPOL's Rules on the Processing of Data. Relevant workstreams may concern human-rights issues under Article 2, prohibited political, military, religious or racial character under Article 3, refugee protection, or use of criminal allegations in an essentially private dispute. These issues require case-specific analysis, not blanket exclusions. A Red Notice is a cooperation request based on a national warrant or judicial order; it is not an international arrest warrant.
We help prepare the mandate, identity documents, chronology, indexed exhibits and factual submissions for the Commission for the Control of INTERPOL's Files (CCF). Work can cover access requests, correction or deletion applications, written objections to continued processing, replies to questions and supplementary evidence. Submission is through the CCF's designated secure portal, subject to its exceptional-channel rules, by the applicant or an authorised representative. Counsel assesses any request for provisional measures; submission alone does not suspend an alert. There is no ordinary appeal from a CCF decision. Revision depends on newly discovered facts likely to have changed the outcome and must meet the applicable requirements, including the six-month period after discovery.
Following a correction or deletion decision, we help counsel organise the outcome, relevant notifications and documented implementation questions. Separate national warrants, domestic wanted lists, immigration records, Schengen Information System alerts and extradition proceedings require their own assessment and remedies. The CCF reviews INTERPOL data compliance; it does not adjudicate guilt or decide extradition. Deletion does not automatically terminate the underlying criminal case or establish that international travel is unrestricted.
An engagement begins with authority, conflict and confidentiality checks, followed by a phased investigative brief and agreed deliverables. We do not claim direct access to restricted INTERPOL databases, affiliation with INTERPOL or the CCF, or guaranteed deletion. 365 ALTERAM provides independent forensic and investigative support; legal advice and representation remain with qualified counsel. CCF applications themselves are free of charge; professional investigation and legal services are separately chargeable.
When the cargo, the contract and the money tell different stories, every link needs to be tested.
365 ALTERAM provides independent forensic review and investigative support in large-scale, cross-border fraud matters involving the global oil and gas industry. We support defence counsel, accused individuals, companies and authorised representatives in examining alleged misconduct across upstream, midstream and downstream activities, including exploration, production, oilfield services, storage, shipping, refining and commodity trading. We reconstruct what was contracted, delivered, recorded and paid, then test the alleged role, knowledge, authority, control and benefit of each person against the available evidence. Findings may support, qualify or contradict an allegation; no outcome is presumed.
We examine suspected fictitious or duplicate trades, non-delivery, diverted payments, inflated invoices, misrepresented counterparties, concealed commissions and disputed use of funds. Contracts, purchase orders, invoices, bank records, letters of credit, guarantees and accounting entries are reconciled with the commercial record. The review distinguishes documented discrepancies, ordinary commercial disputes and unresolved questions from conclusions that require further evidence.
Using lawfully obtained material, we compare bills of lading, terminal receipts, tank and inventory records, meter data, inspection certificates, laboratory reports, customs documents and available vessel or port records. Suspected manipulation of cargo identity, origin, quantity or quality is assessed against source provenance, timestamps, measurement methods and missing records. Relevant petroleum, metering, laboratory and maritime specialists are coordinated where specialist interpretation is required; a single shipping-data point or document is not treated as conclusive proof of delivery or fraud.
We map beneficial ownership, joint ventures, agents, brokers, contractors and other relevant entities alongside authorisations, procurement decisions and payment flows. Investigative work can address alleged bribery, kickbacks, conflicts of interest, procurement manipulation, asset diversion and laundering of suspected proceeds. Financial, corporate and digital records are compared to establish who instructed, approved, knew of or benefited from the transactions, while recording limitations and alternative explanations.
Each engagement begins with mandate, conflict, access and jurisdiction checks. Workstreams preserve provenance and chain of custody, separate facts from analysis and assumptions, and record supportive, adverse and inconclusive findings consistently. Deliverables may include a master chronology, transaction and cargo reconciliation, ownership and fund-flow maps, discrepancy schedules and counsel-ready forensic reports. Legal strategy remains with qualified counsel; technical opinions are provided by appropriately qualified specialists. Initial contact should contain only a neutral summary, relevant jurisdictions and your professional role, without confidential case documents.
A vessel can cross borders in days. The evidence behind a disputed transaction may span years and jurisdictions.
365 ALTERAM provides independent forensic review and investigative support in large-scale, cross-border fraud matters involving the global maritime and offshore industries. We support defence counsel, accused individuals, companies and authorised representatives in examining alleged misconduct involving shipowners, operators, charterers, shipyards, brokers, port and terminal businesses, offshore contractors and project entities. From vessel acquisition and chartering to offshore construction, subsea services, maintenance and decommissioning, we reconstruct the commercial, operational and financial record and test individual responsibility against the available evidence. Findings may support, qualify or contradict an allegation; no outcome is presumed.
We examine suspected fictitious charters or voyages, duplicate or inflated invoicing, diverted freight and hire payments, concealed broker commissions, vessel-sale misrepresentations and disputed delivery or performance. Charterparties, fixture recaps, sale agreements, bills of lading, statements of facts, port records, bunker documents and payment evidence are compared to establish what was agreed, recorded, performed and paid. A contractual disagreement or operational delay is not treated as proof of fraud; conclusions are tested against the full commercial context.
For offshore construction, drilling support, subsea services, marine logistics, maintenance and decommissioning matters, we reconcile tenders, purchase orders, subcontractor records, variation orders, timesheets, equipment logs, progress certificates and invoices. Work can address alleged false billing, overstated mobilisation or standby charges, procurement collusion, kickbacks, misrepresented project progress and diversion of project funds. Technical scope, completion and valuation questions are assessed with appropriately qualified offshore, engineering or quantity-surveying specialists where required.
Lawfully obtained AIS and voyage data, vessel and equipment logs, port-call records, inspection reports, class and maintenance documents, damage surveys and repair records are compared with the alleged chronology. We examine provenance, timestamps, gaps, inconsistencies and possible alteration, including evidence supporting disputed cargo, casualty or insurance claims. AIS positions, data gaps or isolated documents do not by themselves establish a vessel's complete movements, an intentional act or a fraudulent claim. Maritime, surveying and digital specialists are coordinated where their expertise is needed.
We map registered and beneficial ownership, ship-management arrangements, special-purpose companies, joint ventures, agents and intermediaries alongside banking records and decision-making evidence. The review tests who instructed, authorised, knew of, controlled or benefited from the conduct under investigation. Each workstream begins with mandate, conflict, lawful-access and jurisdiction checks, preserves evidential provenance and records supportive, adverse and inconclusive findings consistently. Legal strategy remains with qualified counsel, and technical opinions with appropriately qualified experts. Initial contact should contain a neutral summary, relevant jurisdictions and your professional role, without confidential case documents.
When the visible record is incomplete, the underlying structure may tell another part of the story.
365 ALTERAM specialises in complex forensic investigation of data structures: identifying, reconstructing and analysing deep digital traces within the underlying architecture of software, operating systems and storage media. Where a case requires more than a conventional extraction or a review of visible logs and recovered files, we examine the underlying bits, bytes and structural relationships that explain how a record was created, changed, retained or interpreted. Our work supports defence counsel, accused persons and authorised clients in independently testing digital evidence and substantiating alternative explanations where the available material supports them.
An application screen or exported report is an interpretation of underlying data, not necessarily a complete account of it. We examine relevant binary records, application-specific metadata, database pages and indexes, transaction journals and related structures to assess what is present and how it has been interpreted. Format and software-version differences, incomplete exports and parser behaviour are documented. Structural remnants are not automatically treated as complete, current or committed records.
Where technically feasible, we assess recoverable fragments, damaged records and inconsistencies across application, database, operating-system and storage layers. Suspected alteration is tested against other explanations, including software behaviour, failed writes, corruption, synchronisation and ordinary system activity. We distinguish directly observed bytes from decoded fields, reconstructed relationships and investigative inference. Any reconstruction records the source location, method, assumptions and uncertainty rather than silently filling gaps.
Lawfully acquired memory captures may preserve relevant process state, application structures and transient artefacts that are not available in a file export. Memory is volatile: the timing and method of acquisition affect what can be examined, and live collection can itself change system state. We document those conditions, correlate memory findings with other available sources and avoid equating an isolated fragment with a complete action, a specific user or criminal intent. Recovery depends on the material preserved; overwritten, unavailable or inaccessible data cannot be promised back into existence.
Our objective is to turn technically complex findings into an intelligible, source-linked evidential account suitable for legal scrutiny. Work begins with lawful authority and scope, preserves acquisition and handling records, and documents integrity checks, tool versions and material analytical steps. Relevant findings are independently checked where practicable, with supportive, adverse and inconclusive results reported consistently. Reports can help counsel challenge an existing interpretation or substantiate another evidence-based account. Recovery, completeness and admissibility are not guaranteed; qualified counsel addresses legal use and the competent court determines admissibility.
A threat may target one company. The evidence may reveal a network across borders.
365 ALTERAM provides independent forensic investigation and evidence review in matters involving alleged large-scale, organised extortion targeting businesses worldwide. We support companies, authorised representatives and legal counsel in reconstructing threats, coercive demands, payments and the suspected network behind them. We also assist defence teams in testing allegations against accused individuals. Our work connects communications, digital traces, commercial records and financial flows to examine whether the evidence supports coordinated criminal conduct, who may have directed or benefited from it, and where attribution remains uncertain. Findings may support, qualify or contradict an allegation; criminal involvement is never presumed from association alone.
We examine alleged protection demands, blackmail, threats of violence or business disruption, reputational threats and coercion involving suppliers, contractors, employees or commercial intermediaries. Original messages, correspondence, contracts, incident records, witness accounts and payment demands are placed in a verified chronology. The review distinguishes what was said, what was demanded, what action followed and what remains disputed. An aggressive negotiation, unpaid invoice or contractual disagreement is not automatically treated as extortion; the relevant legal assessment remains with qualified counsel.
Where allegations involve ransomware, threatened disclosure of data, compromised accounts or impersonation, we examine lawfully available message headers, access records, device artefacts, logs and relevant data samples. The work tests authenticity, timestamps, account control, possible spoofing and the relationship between a threat and an actual intrusion or data loss. A username, IP address, telephone number or malware indicator does not by itself identify a person or prove membership of an organised criminal group. We coordinate with appropriately qualified incident-response specialists where containment or recovery is required.
We reconstruct available banking records, invoices, payment instructions and cryptoasset transactions alongside company ownership, directorships, intermediaries and communications. The analysis tests possible common control, repeated demands, division of roles, coordination across incidents and the distribution of proceeds. Relationships are graded by source quality and evidential strength. A transaction link does not automatically establish beneficial ownership, knowledge or criminal intent, and unavailable banking or exchange records remain identified gaps rather than assumed facts.
Each engagement begins with mandate, conflict, lawful-access and jurisdiction checks. We preserve original material where available, document provenance and handling, record integrity checks and distinguish direct observations from reconstruction and inference. Reports include supporting, contradictory and inconclusive findings, individual-role assessments and clearly indexed exhibits for review by counsel, competent authorities or the relevant court. Access to restricted records and compulsory evidence-gathering remain with duly authorised bodies. We do not negotiate payments or make contact with suspected perpetrators under this forensic review service. Initial enquiries should contain a neutral summary and the relevant jurisdictions; sensitive evidence is transferred only through an agreed channel after intake.
Trace the transaction. Test the evidence connecting it to a person.
365 ALTERAM provides independent forensic investigation and evidence review in alleged large-scale cryptocurrency fraud involving businesses, investment operations and suspected organised criminal networks worldwide. We connect available blockchain records with commercial documents, platform data, communications and financial evidence to reconstruct what happened and test who directed, controlled or benefited from the conduct. We support affected businesses, authorised representatives and legal counsel, and independently review allegations for defence teams subject to conflict checks. A transaction trail is the starting point of an investigation, not a substitute for proof of individual responsibility.
Reconstruct alleged investment and token-offering fraud, fictitious trading returns, misappropriated custody assets, exchange misconduct and fraudulent corporate crypto transactions. Compare investor communications, contracts, platform statements, accounting records and available blockchain activity. Distinguish deception or diversion supported by evidence from volatility, business failure, software error or a commercial dispute.
Trace available transfers across relevant wallets, tokens, smart contracts, exchanges and bridges, recording network, transaction hash, block reference, timestamp conventions, token identifiers and analytical steps. Examine fees, swaps and internal platform entries where records are supplied. State gaps, tool dependencies and uncertainty; a public blockchain does not disclose every off-chain ledger movement or the identity behind an address.
Compare transaction records with lawfully obtained account and identity records, device artefacts, communications, signing arrangements, company registers and decision records. Test wallet-clustering assumptions and competing explanations. An address label, common transaction pattern, exchange deposit or technical association alone does not establish ownership, individual control, knowledge or criminal intent.
Map suspected coordination, division of roles, shared infrastructure, corporate intermediaries, repeated schemes and distribution of proceeds across jurisdictions. Grade each relationship by source quality and evidential strength. Test the alleged role of promoters, directors, developers, custodians and facilitators individually, and report contradictory material and unresolved gaps alongside supportive findings.
Work uses lawfully available or authorised material under an agreed mandate. We document evidential provenance, chain of custody, integrity checks, reproducible analytical steps and material limitations. No identity attribution, recovery, admissibility or legal outcome is guaranteed. Legal strategy and representation remain with qualified counsel. Initial enquiries should contain a neutral summary; never send private keys, seed phrases or passwords.
One controlled method across multiple workstreams.
We coordinate country counsel, authorised investigators, language specialists and expert reviewers without confusing international reach with local authority.
Scoped before staffed
We first define the decisions counsel needs to make, the evidence available and the jurisdictions involved. Only then are disciplines, experts, timing and budget assembled around the actual question.
Contact 365 ALTERAM