Computer forensics and technical expert reports
In short: NodePoint prepares technical analyses, assessments of cyber incidents and of the state of networks, and out-of-court expert reports on computers, servers, networks, storage media and video recordings — commissioned by companies, lawyers and individuals. The work is led by Todor Karachorbadzhiev: more than 20 years of practice and a master's degree in forensic engineering and technical expertise (Burgas Free University). Call +359 887 975 180 for a confidential consultation.
Your enquiry is confidential. Do not attach or send any evidence — neither through the form nor on WhatsApp. Describe only the type of device and the question the analysis should answer.
- Mon–Fri 09:00–17:00 · Sat 09:00–12:00
- 47 Tsar Kaloyan St., Burgas
Who computer forensics is for
- Companies — after a cyber incident, a suspected data leak, employee misconduct, a forged document, a dispute with a software or hardware supplier, or when they want an independent assessment of their network and IT systems.
- Lawyers — in civil, commercial and employment disputes where the evidence consists of emails, files, recordings or logs; and to prepare the questions for a court-ordered examination.
- Insurers — for damage to equipment or after a cyber incident.
- Individuals — in a dispute where the key evidence is on a computer, a storage device or a camera recording.
What is a computer forensic examination?
A computer forensic examination is an investigation by a specialist of computers, networks, storage media and digital data that answers specific technical questions — for example when a file was created, how a breach happened or whether a document has been altered. The result is a written report describing the method, the findings and the answers to the questions asked.
Under Bulgarian law, the "forensic computer and technical examination" ordered by a court is type 5.4 of class 5, "Forensic engineering and technical examinations", in Ordinance No. N-1 of 14 February 2023 on the registration, qualification and remuneration of expert witnesses. A related field is class 11 — forensic examinations in digital and communication technologies (for example type 11.4 for video and audio recordings and digital images).
Court-ordered examination vs. private expert report — what is the difference?
A court-ordered examination is assigned by the court or the investigating authority to a registered expert witness, while a private expert report is commissioned by a party. A court-ordered examination is appointed by an act of the authority (in civil proceedings under Art. 195 of the Bulgarian Civil Procedure Code, in criminal proceedings under Art. 144 of the Criminal Procedure Code), and its conclusion is a means of evidence. An out-of-court report helps the party understand the technical side of the dispute, frame the questions for the expert witness and judge whether the case is worth pursuing.
| Item | Court-ordered examination | Out-of-court expert report |
|---|---|---|
| Who orders it | Court, prosecutor, investigating authority | The party — a company, a lawyer, an individual |
| Who performs it | An expert witness appointed by an act of the authority | A specialist chosen by the party |
| The questions | Set by the authority (the parties may propose them) | Set by the client |
| Weight in the case | A means of evidence | The party's opinion — the court weighs it together with the other evidence; it may be the basis for requesting a court-ordered examination |
| When it is useful | When the case has already been filed | Before a case, in negotiations, internal investigations, cyber incidents, insurance claims |
NodePoint prepares out-of-court expert reports, technical analyses and assessments of incidents and networks commissioned by companies and individuals. If a court-ordered examination has been appointed in a case, we can help the party prepare the questions for the expert witness and analyse the conclusion.
What we examine: computers, networks, servers, storage media, video recordings
| Object | Typical questions |
|---|---|
| Computers and laptops | Which files were created, copied or deleted, and when? Which user was working? Is there malware? |
| Networks, servers and logs | How did the breach happen? What data was exfiltrated? Does the network follow good practice and the requirements of the Bulgarian Cybersecurity Act? |
| Storage media (drives, USB sticks, memory cards) | What is the content, including deleted data? When was the device connected to a computer? |
| Video recordings and CCTV systems | Is the recording complete, are there gaps? Is the recording time correct? Was the system working properly? |
| Cloud services, emails and documents | Who is the real sender of the email? Who logged in to the account and when? Has the document been altered? |
| Hardware and software in a commercial dispute | Does what was delivered match the contract? What caused the failure? |
How is digital evidence preserved?
Digital evidence is preserved by leaving the original unchanged and documenting every action taken with it. That is why the examination is carried out on an exact copy of the data rather than on the device itself, whenever this is technically possible.
The steps NodePoint follows:
Intake with a handover record
which device, in what condition, from whom and when; photos; sealing if necessary.
A copy with a checksum
an exact copy (image) of the storage device is made; the checksum (hash) proves that the copy is identical and has not been altered later.
Examination of the copy
the original is kept unchanged.
Documentation
every step, tool and result is recorded, so that another specialist can repeat the examination.
Return with a handover record
the device is returned to the client, and the working copies are kept or destroyed as agreed (see the questions below).
This sequence is called the chain of custody. If it is broken, the other side can challenge the evidence.
What you should do before calling:
- do not switch the device on or off, and do not "check" it more than necessary;
- do not send the files by email or chat — this loses the metadata;
- do not reset the device or uninstall programs;
- write down who had access to the device and when.
Do you have a device that may be evidence? Call +359 887 975 180 before you touch it. Call WhatsApp (opens in a new window)
How to commission an expert report
Confidential conversation
by phone on +359 887 975 180, on WhatsApp or via the form. You describe the type of device and the question, without details about the people involved. The first consultation is free of charge.
Conflict of interest check
NodePoint does not take cases with any connection to the other side.
Brief and quote
in writing: questions, scope, timeframe, price, and what happens to the data afterwards.
Handover of the device
with a handover record (see "How is digital evidence preserved?").
Examination and report
in writing, with a description of the method and an answer to each question.
Clarifications
if needed, for the client or their lawyer.
How is a court-ordered examination appointed in Bulgaria?
A court-ordered computer and technical examination is appointed by the court at the request of a party or of its own motion, when special knowledge is needed to establish the facts; in pre-trial proceedings — by the investigating authority or the prosecutor. The party (through its lawyer) proposes the tasks of the examination. As a rule, the expert witness is chosen from the list of specialists approved as expert witnesses.
Who prepares the analysis
Todor Karachorbadzhiev — managing director of NodePoint (NodePoint EOOD).
- More than 20 years of hands-on experience building and maintaining computer networks, servers, computers, CCTV and cloud services — the same technology that is examined in the analyses.
- Master's degree in Forensic Engineering and Technical Expertise and Technical Safety, Burgas Free University (2025).
- Master's degree in Integrated Computer Systems and Complexes, Burgas Free University (2025).
- Leads the development of the cybersecurity awareness training platform Sentinel by NodePoint.
Full profile of the expert · LinkedIn (external website, opens in a new window)
Impartiality: an expert report answers the technical questions as the findings stand — including when they are not in the client's favour. That is what makes it useful: it shows the strength of your position before the other side tests it.
How much does an examination cost and how long does it take?
The price and timeframe depend on the number and type of devices, the volume of data and the number of questions. One laptop with one question is a different task from several computers and a server. NodePoint gives a written quote after the confidential conversation, which is free of charge.
The fees of expert witnesses in court-ordered examinations are set by the authority that appoints the examination, under Ordinance No. N-1 of 2023, not by the contractor's price list.
Frequently asked questions about computer forensics
Who can carry out a computer forensic examination for a court in Burgas?
A court-ordered examination is assigned by the court to an expert witness, as a rule from the list of specialists approved as expert witnesses. Before or outside a case, a party can commission an out-of-court expert report from a specialist — NodePoint in Burgas prepares such reports and technical analyses for computers, networks, servers, storage media and video recordings.
Can a deleted file or email be evidence?
Yes, if it can be recovered and if it has been preserved in a way that proves it has not been altered. Whether deleted data can be recovered depends on the device, the software, the time since deletion and whether there was a backup. The less the device has been used since the deletion, the better the chances.
Is a screenshot enough as evidence?
A screenshot is often not enough, because it contains no metadata and is easily challenged as fabricated. Stronger evidence is an examination of the device itself or of an exact copy of it, with the method described. Screenshots are useful as a pointer to what to look for.
What is the chain of custody and why does it matter?
The chain of custody is the documented history of a piece of evidence — who received, copied, examined and returned it, when and how. It matters because it proves that the data has not been altered; if there is a gap, the other side can challenge the evidence. NodePoint keeps a record of every handover, works on a copy with a checksum and records every step.
What happens to the data and copies after the work is finished?
The original device is returned to the client with a handover record immediately after the examination. Working copies and extracted data are kept encrypted, accessible only to the contractor, for the period set in the brief — by default up to 6 months after the report is delivered, so that questions about it can be answered. After that they are securely destroyed with a record or, at your request, handed over to you on a storage device.
Will you see my personal data and photos?
The specialist examines only what is needed to answer the questions asked and keeps everything else confidential. The scope of the examination is recorded in the brief. The data is not used for any other purpose and is not disclosed to third parties unless the law requires it.
Can I contact you on WhatsApp about an examination?
Yes, to describe the question and arrange a call. Do not send files, photos or recordings that may become evidence in the chat — this loses the metadata and breaks the chain of custody. The handover of evidence is arranged separately.
Do I have to bring the device in person?
Yes, as a rule the device is handed over in person against a handover record, not by courier without an inventory. That way the chain of custody starts on a documented basis. If the device is in another city, the method of handover is agreed in advance by phone.
Sources
- Ordinance No. N-1 of 14 February 2023 on the registration, qualification and remuneration of expert witnesses (State Gazette No. 18 of 2023, last amended State Gazette No. 89 of 2025) — Annex No. 1, class 5, type 5.4.
- Bulgarian Civil Procedure Code — Art. 195 (appointment of an expert witness).
- Bulgarian Criminal Procedure Code — Art. 144 (appointment of an examination).
- The official texts (in Bulgarian) are available in the State Gazette (https://dv.parliament.bg/) and in legal information systems; checked on 5 November 2026.
Confidential enquiry
Call for a confidential consultation, message us on WhatsApp or send an enquiry. We reply within 24 hours during business hours. Do not send evidence — describe only the device and the question.
- Call: +359 887 975 180Mon–Fri 09:00–17:00, Sat 09:00–12:00 (Bulgarian time).
- Message us on WhatsAppYou can send a photo of the fault or of the site. (opens in a new window)
- Send an enquiryThe form is just below.
Thank you!
We have received your enquiry and will reply within 24 hours during business hours. If it is urgent, call +359 887 975 180.
Do not send any evidence before we have spoken — we will agree how to hand it over so that it keeps its evidential value.
The form was not sent. Please try again or call us on +359 887 975 180.