by The Computing Australia Group | 
When a receiver, administrator or liquidator is appointed, the company’s laptops, email and cloud accounts become some of its most valuable records. Insolvency forensics is the work of securing that data quickly, then turning it into findings you can rely on. Done early, it protects the evidence. Left too late, it can disappear with a lapsed subscription or a well-meaning IT clean-up.
This guide explains what to secure in the first days, how the forensic process works and what a useful report looks like. We wrote it for insolvency practitioners and their lawyers, in plain English.
Updated 29 October 2026
What’s changed for insolvency forensics
- New ASIC reporting guidance. ASIC reissued Regulatory Guide 16 in July 2025, setting out its expectations for how external administrators and controllers report possible offences and misconduct.
- A statutory privacy tort. Since 10 June 2025, individuals can sue for serious invasions of privacy. As a result, targeted and proportionate collection matters more than ever.
- Ransomware payments must be reported. Since 30 May 2025, businesses above a $3 million annual turnover threshold must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours.
- Records now live in the cloud. Most company data sits in Microsoft 365, Google Workspace and cloud accounting rather than on an office server, so admin access matters as much as hardware.
Why digital evidence matters in an insolvency
Under the Corporations Act, a company’s books include electronic records, and officers must hand them over to a liquidator. In addition, external administrators must look into the company’s affairs and report possible offences or misconduct to ASIC. In practice, most of those books are now emails, spreadsheets, accounting files and chat messages.
The trouble is that digital records are fragile. For example, cloud services suspend accounts when bills stop being paid. Similarly, departing staff take laptops home. Meanwhile, an outsourced IT provider may reset devices or close accounts without realising they hold evidence. Each of these can wipe out the trail you need.
Unpaid subscriptions
Microsoft 365, Google Workspace and cloud accounting can suspend, then delete, data once payments stop.
Departing people
Directors and staff may hold company laptops, phones and logins, or keep copies in personal accounts.
Third-party admins
The company’s IT provider often holds the passwords. Without clear instructions, routine changes can destroy evidence.
Insolvency forensics in the first days of an appointment
In insolvency forensics, speed matters most at the start. Before anyone analyses anything, the priority is to stop data being lost or changed. These are the steps we recommend.
- Identify every system, from email and file storage to accounting, CRM and backups, and who has admin access to each.
- Take control of admin accounts, change shared passwords and disable logins for staff who have left.
- Tell the IT provider in writing to preserve data and pause any clean-up, resets or account closures.
- Keep essential cloud subscriptions paid until the data has been collected.
- Collect company laptops and phones, and record who handed over what and when.
- Avoid logging in to or browsing suspect devices, because that changes the evidence.
How the insolvency forensics process works
Of course, every matter is different. Even so, a sound engagement follows the same basic path, so that the results stand up to scrutiny.
Triage
A short call to understand the appointment, the urgent risks and the questions you need answered.
Scope
Agree which people, systems and date ranges matter, so collection stays focused and proportionate.
Preserve
Make forensic copies of devices and export cloud data, without changing the originals.
Verify
Record hash values and a chain of custody, so anyone can confirm the copies are complete and unaltered.
Analyse
Build timelines, recover deleted material and search email, files and audit logs for the issues in scope.
Report
Set out findings in plain English, with exhibits and clear limitations, ready for your reports and advisers.
For very large mailboxes, search tools, including AI-assisted ones, can help narrow down what needs reading. However, a person always reviews the results before anything goes into a report.
What forensic analysis can uncover
Most insolvency forensics work starts with a specific concern. Below are the questions we are most often asked to help answer.
Suspicious payments
Who approved transfers before the appointment, and what emails, invoices or messages surround them.
“Missing” records
Whether files or accounting data were deleted, moved or never existed, and whether they can be recovered.
Moved assets
Clues in registers, invoices and correspondence that show stock, equipment or funds being shifted elsewhere.
Data taken by insiders
Evidence of USB copying, uploads to personal cloud storage or rules forwarding email outside the company.
Altered documents
File metadata and version history that show whether a document was created or changed after the fact.
Who knew what, when
A timeline of emails, calendars and chats that shows when directors were warned about solvency.
Sources of evidence that are easy to miss
Beyond laptops and the main mailbox, check Microsoft 365 or Google Workspace audit logs, accounting audit trails, bank portal exports, backups, Teams or Slack chats, CRM history and the IT provider’s own support tickets. Often, the most useful record is a log nobody thought to keep.
Three common scenarios
For instance, these composite examples show how insolvency forensics plays out in practice.
Payments before appointment
A liquidator queries large transfers to a related company. Email and accounting audit trails show who approved them and what the directors knew at the time.
The records “don’t exist”
Directors say the company kept few records. A forensic copy of the finance laptop and the cloud backup recovers the deleted ledgers.
Client data walks out
Staff leave to start a competitor. Device and cloud logs show customer lists uploaded to personal storage days before they resigned.
Legal and privacy points to keep in mind
Insolvency forensics sits alongside legal advice, never in place of it. In particular, keep these points in view.
- Chain of custody. Record every handover of a device or copy, and verify copies with hash values.
- Privacy and proportionality. The Privacy Act still applies to personal information on company systems. Therefore, target collection and searches to the issues in scope, and keep private material out of reports.
- Data breaches. If the investigation finds that personal information was exposed, the Notifiable Data Breaches scheme may apply.
- Ransom payments. If the company paid a ransom before the appointment, check whether the company reported it to the ASD as required.
- Court proceedings. If a matter heads to court, your lawyers will advise on how to prepare evidence and who should give expert evidence.
What a good insolvency forensics report includes
After all, a report is only as useful as it is clear. Ultimately, it should help you write your statutory reports and decide on recovery action.
- The questions asked, and the scope agreed
- Every source collected, how it was collected and its hash value
- The tools and methods used, described in plain English
- Findings linked to exhibits such as emails, logs and file listings
- Limitations, gaps and anything that could not be verified
- A short summary you can use in creditor and ASIC reports
How CAG helps insolvency practitioners
Our team preserves company data and analyses it, then reports on what we find. We work alongside your lawyers and the company’s IT provider, and our rapid response helps lock down systems before evidence is lost.
- Securing admin access across email, cloud and accounting systems
- Forensic copies of laptops, desktops, servers and cloud accounts
- Verified, documented chain of custody
- Analysis of email, files, audit logs and deleted data
- Clear written reports with exhibits
We also support the wider clean-up, from cyber security services to data and disaster recovery.
Rapid response
Need company data secured quickly?
Call our Perth team on 1300 790 166. We’ll help you lock down systems, preserve the evidence and plan the analysis.
Insolvency forensics: frequently asked questions
How quickly can evidence be preserved?
We offer a rapid response and prioritise data that is most at risk, such as cloud accounts that may be suspended and devices still in use. The sooner you call after an appointment, the more there is to save.
Do systems need to be taken offline?
Not usually. We plan collection to keep disruption low, for example by exporting cloud data and copying devices while the business keeps trading.
Can deleted files and emails be recovered?
Often, yes. Deleted material can survive in recycle bins, backups, cloud retention settings and unused space on a drive. However, the chances fall the longer devices stay in use.
How do you handle personal information?
We keep searches targeted to the issues in scope, separate out private and privileged material, and handle data in line with the Privacy Act.
Can your reports support our ASIC reporting?
Yes. Our reports set out findings and exhibits in a clear structure that you can draw on for your statutory reports. Decisions about what to report remain yours.
Should our lawyers be involved?
Usually, yes. Involving them early helps set the scope, protect privilege and prepare for any proceedings.
What happens to the evidence afterwards?
We agree retention and destruction terms at the start, and keep a record of every copy until it is returned or securely destroyed.
Sources and further reading
- ASIC — RG 16: Reporting of possible offences and misconduct
- OAIC — Statutory tort for serious invasions of privacy
- OAIC — Notifiable data breaches
- Australian Signals Directorate — Report and recover
- Federal Register of Legislation — Corporations Act 2001
This guide is general information, not legal advice. Last reviewed 29 October 2026.
About the author
Chris Karapetcoff
Director (Client Growth and Success), The Computing Australia Group
Chris has worked with The Computing Australia Group for over 20 years and looks after its client relationships. He helps organisations get outstanding value from their IT spend, with plain-English advice and a complete IT solution they can build on. As he tells every client: your IT system should just work.
