Selected Engagements

The work, without the names.

Discretion is the foundation of everything we do. The case studies below illustrate how Greyline approaches three of our most-requested engagement types — drawn from real patterns of work, presented in a form that protects every client and subject involved.

Composite case studies based on representative engagements. Names, locations, sectors, monetary figures and identifying details have been altered or merged across multiple instructions to protect client confidentiality. The investigative methodology, scorecard outputs and outcomes reflect the standard of work Greyline delivers.

The Brief

A client in her early thirties approached Greyline after a year of small inconsistencies — late returns from work trips, a second phone she had glimpsed once, a sudden interest in privacy on shared devices. She did not want a confrontation. She wanted to know, calmly and on her own terms, whether the relationship she was about to commit to long-term was what it appeared to be.

Our Approach

We opened with a Digital Footprint Scorecard on the subject — a non-intrusive review of public-facing online presence, professional registries, and metadata patterns from communications already lawfully held by the client. Where the scorecard surfaced amber and red signals, we deployed lawful physical observation across three pre-identified high-probability windows, coordinated with a female lead investigator for two of them. No covert recording, no device interference, no pretexting of third parties.

Digital Footprint Scorecard — Initial Assessment
IdentityTwo active professional profiles, one under a partial alias
LocationGeotag inconsistencies on three of seven referenced trips
NetworksConcealed mutual contact with a recurring third party
FinancialNo anomalies in lawfully shared accounts

What We Found

Two of the three "work trips" referenced in the brief had not occurred at the stated locations. A pattern of meetings at a single residential address — not the subject's home or workplace — was documented across the engagement window. The third party was identified through open-source means only; no covert intrusion was required.

Outcome

The client received a written report, a chronological observation log, and corroborating photography taken in public spaces only. She used the report privately, with a solicitor of her own choosing. Greyline made no recommendation as to her decision. She was not pressured, not lectured, and not contacted after the engagement closed beyond a single confirmation that the file had been securely retained for the agreed retention window.

21
days from intake to final report
3
independently corroborated observations
0
lawful or ethical breaches in evidence chain

I did not want someone to tell me what to do. I wanted someone to tell me what was true. They did exactly that and then they stepped back. — Client, anonymised

The Brief

A claimant company had paid a substantial invoice to what it believed was a long-standing supplier. The bank details had been changed by email three days before payment. Within forty-eight hours of the funds clearing, they had been moved through two intermediary accounts and partially converted to cryptocurrency. The instructing solicitors needed evidentially robust tracing material to support a freezing application and a Bankers Trust order.

Our Approach

Our digital forensics team triaged the email environment first, identifying the point of compromise — a forwarding rule silently installed on a finance mailbox six weeks earlier. In parallel, our cryptocurrency tracing analysts followed the on-chain trail through a peel chain into a clustered wallet group attributable, with high confidence, to a specific exchange. OSINT enrichment tied two of the intermediary fiat accounts to documented mule patterns we had previously catalogued.

Tracing Confidence Scorecard
Email vectorConclusively identified — forensic artefacts preserved
Fiat trailTwo-hop chain documented to named institution
Crypto trailClustered to identifiable VASP — KYC subject to disclosure
Evidential chainHashed, logged, ready for civil disclosure

What We Delivered

A tracing report admissible as expert evidence; a chain-of-custody log for every artefact handled; a wallet attribution memorandum with on-chain visualisations; and a witness statement prepared in the form expected by the court. The instructing solicitors used the package to support a successful without-notice application.

Outcome

A meaningful proportion of the misappropriated funds was preserved at the regulated exchange identified in our work and ultimately recovered through proceedings. The compromise vector was closed. The client's finance team received a tailored briefing on the indicators they had narrowly missed, so the same pattern could not run twice.

9 wks
from instruction to court-ready evidence
100%
of artefacts admitted without challenge
~70%
of traced funds preserved at intervention point

The evidential discipline was the difference. We had something a judge could rely on, not a narrative we had to defend. — Instructing partner, anonymised

The Brief

A senior employee had resigned and joined a direct competitor. Within a fortnight, the client noticed that two prospective tenders they had been quietly preparing were being competed for — accurately, and aggressively — by the new employer. The board needed to know whether confidential material had left the building, and if so, what, when, and by what route.

Our Approach

We executed a forensically sound acquisition of the departing employee's issued devices and a targeted review of cloud activity logs across the final 90 days of access. In parallel, our offensive security team conducted a controlled assessment of the data exfiltration paths the employee had access to — not to attribute, but to map what was technically possible. The two streams were then reconciled.

Insider Threat Scorecard
VolumeAnomalous download burst within final 14 days of access
ChannelPersonal cloud sync intermittently active on issued laptop
IntentPattern consistent with curation, not routine use
Control gapDLP rule scope did not cover the channel observed

What We Found

Two specific document sets — one of them the tender material — had been synchronised to a personal cloud account in the final week of employment. The forensic record was unambiguous: filenames, timestamps, hashes and the offline-online sync events were all preserved. The control gap that allowed it was mapped and documented.

Outcome

The client's solicitors used the report to send a precisely scoped letter before action. The competitor returned and certified destruction of the relevant material under independent supervision, and the prospective tender process was re-set. In the hardening phase that followed, we closed the DLP gap, tightened off-boarding, and ran a tabletop exercise with the leadership team so the same pattern would be visible far earlier next time.

14 days
from board instruction to evidential report
2
document sets recovered and certified destroyed
1
control gap closed before next departure cycle

We expected a forensic report. We received a forensic report, a legal lever, and a quieter Monday morning. That is the order it should arrive in. — Board chair, anonymised

Begin Your Engagement

Your matter will not appear here. That is the point.

Every Greyline engagement is conducted under strict confidentiality. We communicate by email and Google Meet, we work to defined scopes, and the only people who will ever know the work happened are the people you choose to tell.

Begin Confidential Inquiry →