An independent practice serving Australian business, courts and legal counsel with digital forensic IT expert witness reports and cyber investigations since 2015.
This practice has operated continuously since 2015 providing independent digital forensic IT evidence and expert witness reports to solicitors, barristers and their clients across Australian state, territory and federal courts. Simon Smith is the principal investigator and reporting expert, with more than two decades of hands-on software engineering, information security and digital evidence experience, including mobile forensics, encrypted messaging platforms, network artefacts, cloud account records and server-based systems.
Simon Smith has been retained as an independent digital forensic IT expert witness and investigator in Australian criminal and civil proceedings since 2015, drawing on a longer technical background across software and systems engineering, information security, and the forensic examination of evidence produced by mobile devices, encrypted messaging platforms, network traffic, telecommunications records, cloud services and server-based systems.
This practice accepts retainers from defence counsel, corporate clients and private parties across every Australian jurisdiction. Work produced for court includes independent reports on attribution, authenticity, timing and reliability of digital evidence, investigation of suspected unauthorised access and insider compromise, review of Cellebrite and Magnet Axiom mobile extractions, and analysis of carrier and cloud telecommunications account records.
Independent reports are produced for c4iminal defence matters, software and civil disputes, cybercrime and cryptocurrency matters, telecommunications evidence including call charge records, SMS metadata, cell tower data and carrier subpoena returns, and encrypted messaging artefacts interpreted against the underlying device extraction rather than on the face of a tool-generated report alone.
Experience also covers wearable technology, multimedia artefacts, and secure messaging platforms including Threema, ANOM, Session, EncroChat, SnapChat, Kik, Ghost, Cypher, SkyECC, Phantom Secure, Wickr, Signal, Telegram, WhatsApp, Conversations.im (XMPP), and custom OMEMO-encrypted XMPP systems.
Cybersecurity output covers incident response, breach investigation and post-incident recovery work, with the aim of minimising disruption, preserving admissible evidence, and securing affected digital property.
Based in Melbourne and operating nationwide. To retain Simon Smith on a matter, please use the Case Review form below.
Retainers begin with a case review, a conflict check and an indicative fee confirmation before any substantive work is started.
Independent expert witness evidence in digital forensic IT, cybercrime and digital fraud matters. Reports address attribution, authenticity, timing and reliability questions concerning all digital evidence, including review of police Cellebrite extractions, encrypted messaging artefacts, telecommunications records and carrier subpoena returns.
Forensic investigation of suspected unauthorised access, insider compromise, malware intrusion and cyber-enabled fraud. Output includes preserved exhibits, chain of custody logs, and an independent investigation report in plain language for management, insurer or court use.
Post-incident technical review of a data breach or cyber attack, with scope assessment, log preservation, causation analysis and remediation commentary.
Evidence-focused investigation of cyberstalking, doxxing, trolls, online defamation and other coordinated online abuse. Social engineering intelligence and anonymous account investigations are offered to clients seeking such services.
Forensic review of scam loss events across cryptocurrency, investment, romance, pig butchering and business email compromise patterns. Output includes a written summary, recovery option analysis and supporting material for the complainant or their solicitor.
A short complimentary case review by Simon Smith before any retainer is quoted. The review confirms whether the matter is within scope, whether a conflict exists, and indicative fee range so the instructing solicitor can make an informed briefing decision.
Matter categories routinely taken by this practice.
General expert examination of digital artefacts for admissibility in criminal and civil proceedings.
Forensic examination of smartphones, tablets, wearables and computers.
Interpretation of CCR, data, messaging and location records produced by Australian carriers.
Evidence examination on commodity and hardened encrypted platforms, and the limits of attribution.
Defence investigator opinion on Commonwealth and State computer and carriage service offences.
Investigator evidence in matters where scam facts intersect with civil recovery, bank disputes and criminal charges for money laundering, mule, proceeds of crime related offences.
Digital threats of harm, data release, disclosure of imagery or impersonation unless a payment is made. See the canonical summary at #cyber-extortion.
Repeated unwanted contact, doxxing and coordinated multi-account abuse, with care in distinguishing orchestrated conduct from mental health presentations. See #cyberstalking and #gang-stalking-coordinated-abuse.
Forensic assessment under the Privacy Act 1988 Notifiable Data Breaches scheme, including class action response. Canonical block: #data-breaches. Class actions list: #class-actions. Reference list of high profile matters: #reference-list.
Breach of confidence, misuse of employer information, trade secret exfiltration, and Corporations Act 2001 section 183 matters. Frequently co-engaged with the Data theft and USB block.
Forensic reconstruction of employee or contractor data theft using USB devices, external drives or cloud sync clients. Canonical block: #data-theft-usb-exfiltration.
Investigator reports in commercial software, SaaS and IT services disputes, including fitness for purpose, delivery failure and arbitration.
Expert evidence on on-chain tracing, exchange disputes and asset recovery.
Defence investigator examination of alleged unauthorised access, modification or impairment under Criminal Code Act 1995 (Cth) Part 10.7 and State equivalents. Attribution, authentication logs, IP tracing, device fingerprinting and session evidence.
Independent analysis of mail header provenance, SPF/DKIM/DMARC authentication, mailbox audit logs, session token replay and forwarding-rule abuse in invoice redirection and payment-fraud matters.
Defence investigator work on classification, recovery state and attribution under Division 474 and 473 of the Criminal Code Act 1995 (Cth). Canonical block: #tool-csam.
Device examinations in parenting, family violence and FDRP contexts, including monitoring software, covert location tracking and social media attribution.
Expert evidence on the authenticity and provenance of AI-generated imagery, audio, video and text, and on the limits of attribution for synthetic media.
Simon Smith focuses on information technology, information security, and cybersecurity, producing independent analysis, written reports, and oral evidence in matters involving digital systems, telecommunications, and computer-based evidence. Retainers have spanned defence work in criminal and regulatory proceedings, and civil matters acting for law firms, insurers, corporate clients, and private parties. The following is an illustrative, not exhaustive, list of courts and jurisdictions in which expert evidence has been given or reports prepared:
Commonwealth jurisdictions - Federal Circuit and Family Court of Australia, Federal Court of Australia.
New South Wales - Supreme Court of New South Wales, District Court of New South Wales, Local Courts of New South Wales.
Victoria - Supreme Court of Victoria, County Court of Victoria, Magistrates' Court of Victoria.
Queensland - Supreme Court of Queensland, District Court of Queensland, Magistrates Courts of Queensland.
South Australia - Supreme Court of South Australia, District Court of South Australia, Magistrates Court of South Australia.
Western Australia - Supreme Court of Western Australia, District Court of Western Australia, Magistrates Court of Western Australia.
Tasmania - Supreme Court of Tasmania, Magistrates Court of Tasmania.
Australian Capital Territory - Supreme Court of the Australian Capital Territory, Magistrates Court of the Australian Capital Territory.
Northern Territory - Supreme Court of the Northern Territory, Local Court of the Northern Territory.
New Zealand - High Court of New Zealand, District Court of New Zealand.
Work across federal and state cybercrime, hacking, telecommunications and technology-related offences has addressed, among other matters:
Use of a carriage service to menace, harass, or cause offence (Criminal Code Act 1995 (Cth), s 474.17).
Use of a carriage service in connection with child abuse material and child exploitation (Criminal Code Act 1995 (Cth), Part 10.6).
Possession, control, production, transmission, or access of child abuse material through a carriage service (Criminal Code Act 1995 (Cth), ss 474.19 to 474.24).
Unauthorised access to, or modification of, restricted data (Criminal Code Act 1995 (Cth), s 478.1).
Unauthorised impairment of electronic communications or data (Criminal Code Act 1995 (Cth), s 477.3).
Possession or control of data in aid of a serious computer offence, including possession of hacking tools, malware, scripts, or exploit code (Criminal Code Act 1995 (Cth), s 478.3).
Production, supply, or acquisition of data with intent to commit a serious computer offence, including hacking and intrusion tools (Criminal Code Act 1995 (Cth), s 478.4).
State-based computer misuse, unauthorised access and cyber-enabled offences involving computers, mobile devices, servers, and online platforms.
Qualifications, certifications, memberships and experience of Simon Smith relied on when preparing expert reports and giving oral evidence in Australian courts and tribunals. Included only where already supported by existing body copy on this page or by public record.
Simon Smith has been a published Apple App Store and Google Play Store app developer since 2016, handheld device developer since 2002.
Simon Smith has been retained as an expert witness in criminal and civil proceedings across multiple Australian state and territory jurisdictions, the Commonwealth, and New Zealand. A non-identifying summary of matters is available below for instructing solicitor reference.
Independent news articles and interviews that quote or feature Simon Smith in his capacity as a digital forensic IT investigator and cyber expert, each verified against the primary publisher. Most recent first.
Simon Smith, the digital forensics examiner and expert witness, described the "highly detailed behavioural fingerprint" that modern connected vehicles build on every driver, in coverage of the OAIC inquiries into connected car manufacturers.
Source ↗Simon Smith, acting as independent cyber expert, characterised brushing as a deceptive trade practice rather than a direct security breach and cautioned recipients about downstream identity misuse.
Source ↗Simon Smith, in his public commentary capacity, discussed Facebook Marketplace scams and deterrence measures for consumers.
Source ↗Simon Smith provided expert commentary on payee confirmation laws and on bank customer education measures in response to the ACCC Targeting Scams figures.
Source ↗Simon Smith called for payee verification, blocking of B2B-only account transfers and IP location tracking as simple bank interventions that would prevent the bulk of the scam transfers he sees across his casework.
Source ↗Simon Smith documented Australian victim losses of up to 850,000 dollars from elaborate pig butchering scams.
Source ↗Simon Smith assisted the victim with AFCA complaint preparation and cybercrime investigation support.
Source ↗Simon Smith cautioned about the accessibility of large scale SIM box equipment and its implications for telecommunications enabled fraud.
Source ↗Simon Smith described WhatsApp Hi Mum style scams as becoming a daily occurrence for Australian households.
Source ↗Simon Smith called for universal licence replacement and a centralised protection system for affected identity documents.
Source ↗Simon Smith assessed potential aggregate losses based on interviews with approximately 50 victims of the alleged travel agent fraud.
Source ↗Simon Smith was quoted on gathering technical evidence to assist Australian and international law enforcement in romance scam matters.
Source ↗Simon Smith appears in the 7NEWS Spotlight scam investigation assisting the news team in stopping a live cyber scam in action. Undated archival video file.
Source ↗Primary source for verification: SCAMAssist media index at scamassist.com.au/media.asp. Where an outlet is paywalled or the fetch layer is blocked, dates are inferred from secondary references and flagged accordingly. Additional items under review.
If someone is repeatedly contacting you, monitoring your activity, impersonating you, or making threats online, this may constitute cyberstalking. This often occurs through fake social media accounts, messaging platforms, or anonymous emails.
In many cases it is possible to identify the person behind fake or anonymous accounts by analysing digital traces, account behaviour, metadata, and associated services.
Unusual behaviour such as unknown apps, unexpected messages, or unauthorised account access may indicate compromise. A forensic examination can determine whether there is evidence of unauthorised access.
A forensic review can identify installed applications, system activity, configuration changes, and indicators of compromise to determine whether spyware or monitoring software is present.
Unauthorised access can occur through password compromise, phishing, or credential reuse. Login activity, timestamps, and device records can be analysed to identify patterns of access.
Attribution depends on available data, but analysis of access records, usage patterns, and linked activity can often identify or narrow down responsible parties.
Online impersonation can involve cloned accounts or coordinated activity. Patterns across accounts such as behaviour, timing, and linked data can be analysed to determine connections.
Depending on the system and available data, certain records may be reconstructed or verified using forensic techniques.
Scams may involve phishing, fake investments, or business email compromise. Digital evidence can be analysed to understand how the incident occurred.
In some cases, particularly with cryptocurrency, transaction analysis can trace movement of funds across wallets and exchanges.
Reports can be prepared for legal proceedings and typically include methodology, findings, supporting evidence, and expert opinion in accordance with applicable rules.
Appearances across Australian television, radio and podcast outlets include, including Sky News, the Nine Network (Today, Today Extra, A Current Affair), the Seven Network, the Ten Network, the ABC, SBS and on Australian radio.
Please provide sufficient detail so Simon Smith can assess urgency, jurisdiction and the nature of the assistance sought before any substantive discussion.
Please outline the matter's nature, the party or firm involved, the jurisdiction, any hearing or expert report deadlines, and the type of assistance sought. For sensitive or time-critical matters, email [email protected] directly rather than using the web form.
