Independent digital and mobile forensic investigation for a national sporting federation
Commissioned by executive leadership and internal audit to establish, on defensible evidence, whether sensitive information reaching the media had left the organisation’s own systems and devices.
Client
A national sporting federation (named client withheld)
Sector
Sport administration and governance
Period
2016 to 2018, across several separate appointments
Commissioned by
Executive leadership together with internal audit
Discipline
Managed Cybersecurity (Digital Forensics)
Framing
Governance and risk intervention
The situation
Between 2016 and 2018 the federation was operating under sustained media scrutiny and internal governance pressure, with sensitive information appearing in the public domain and no established basis on which to determine whether those disclosures had originated inside the organisation’s own systems and devices. Sourceworx was appointed on several separate occasions across that period, each time commissioned by executive leadership together with internal audit, and the work was framed from the outset as a governance and risk intervention that had to produce findings capable of surviving external challenge.
The appointment was made on an independent basis, since the internal IT function fell within the scope of the assessment and could not therefore be the body conducting it. Each appointment was authorised at executive and internal audit level before any acquisition began.
Scope of work
- Mobile device forensics across multiple members of the executive
- Forensic analysis of Office 365 Exchange mailboxes
- A structured assessment of whether the information disclosures originated from the federation’s systems or devices
- Defensible written reporting for the use of executive leadership and internal audit
Forensic method
Every appointment followed formal forensic methodology. Evidence acquisition was performed under controlled conditions, each acquired image was cryptographically hashed so its integrity could be established at the point of collection and demonstrated at any later date, chain of custody was documented from acquisition through analysis to reporting, and findings were written to a standard that would hold if the matter travelled further than an internal report.
Because the work reached the devices of named senior individuals as well as the organisation’s Office 365 environment, the scope of each appointment was agreed in writing before any acquisition took place, and the boundary between what had been authorised for examination and what had not was recorded as part of the case file.
What the client received
The deliverable in each appointment was a written forensic report setting out what was acquired, how it was acquired, what the analysis established and what the analysis could not establish — giving executive leadership and internal audit a documented factual position from which to act.
Confidentiality
Findings are covered by the confidentiality terms of the engagements and are not disclosed here. The client is withheld by design on this page.
Where this sits in the Sourceworx offering today
Digital forensics sits inside Managed Cybersecurity alongside vulnerability assessment and penetration testing, managed detection and response, incident response and POPIA compliance consulting. Forensic work is delivered using Detego, one of the Performance Extensions in the Sourceworx portfolio, which supports court‑admissible evidence handling and cost recovery support. Sourceworx holds ISO 27001 certification and runs a 24‑hour Network and Security Operations Centre, and the same team that carries out the investigation supports clients through the notification obligations that POPIA now attaches to a confirmed compromise of personal information.
Want a similar outcome documented for your organisation?
No slide decks. No generic proposals. A conversation about your environment, your sector and your priorities.
Talk to us