1. Mobile Device Forensics and Data Recovery
Forensic acquisition, extraction, examination and lawful recovery of data from smartphones, feature phones, SIM cards, memory cards, tablets, smart watches, GPS devices, drones and digital cameras. Services may include recovery and analysis of messages, calls, contacts, application data, photographs, videos, documents, location records and deleted data, where technically possible.
2. Computer, Server and Storage Forensics
Forensic imaging, preservation, examination and recovery of data from desktop computers, laptops, servers, hard drives, solid-state drives, flash drives, memory cards and other storage media. Services may include deleted-data recovery, volatile-memory acquisition, user-activity reconstruction, file-system analysis and digital timeline development.
3. Network and Cyber-Incident Forensics
Collection and analysis of network traffic, security logs and infrastructure artefacts to investigate cyberattacks, unauthorised access, suspicious communications, data leakage and affected systems. Evidence may include firewall, router, switch, VPN, IDS/IPS, server, cloud and packet-capture records.
4. Malware, Memory and Specialised Digital Analysis
Static, dynamic and memory-based analysis of suspicious software, scripts, attachments, URLs and system artefacts to determine behaviour, persistence, communication, impact and indicators of compromise.
5. Digital Media Authenticity and Emerging-Technology Forensics
Technical examination of digital documents, email, messages, photographs, audio, video, CCTV/DVR exports and screenshots to assess integrity, metadata and alteration indicators. RFI may also examine cloud, Internet of Things and other emerging-technology evidence, subject to legal and technical assessment.
6. Expert Consultation, Legal and Court Support
Interpretation of digital forensic findings, preparation of court-admissible reports, expert consultation, presentation of findings and expert-witness testimony for judicial, investigative, regulatory, disciplinary or administrative proceedings.
What Our Services Support
Criminal and cybercrime investigations
Fraud, financial crime, corruption and economic-crime investigations
Civil litigation and administrative proceedings
Corporate and internal investigations
Cybersecurity incident investigation and reconstruction
Electronic evidence preservation and lawful data recovery
Expert interpretation and presentation of digital evidence
Who May Request the Services?
| Client Category | Who Is Included |
| Public Institutions | Law-enforcement and justice institutions, ministries, Government agencies, regulators, local government, public ICT institutions and critical-infrastructure operators. |
| Private Sector | Banks, financial institutions, telecommunications and internet providers, insurers, ICT companies, businesses, professional firms and other registered organisations. |
| Individuals | Members of the public requesting services for devices, accounts, files or data they lawfully own or are legally authorised to submit. |
How to Request a Digital Forensic Service
Submit an official request letter or approved service application describing the required service, incident or dispute, available evidence and purpose of examination.
Provide proof of lawful authority, ownership or institutional authorisation, together with relevant case or incident information.
RFI conducts a preliminary legal and technical assessment to confirm evidence condition, feasibility, scope, expected output and estimated turnaround.
RFI communicates the applicable charge and provides secure instructions for physical submission, approved electronic transfer or authorised on-site evidence acquisition.
After acceptance, the request is registered and tracked through the RFI Laboratory Information Management System (LIMS), and the authorised forensic examination is conducted.
The final report and approved outputs are released only to authorised recipients through controlled physical collection, official dispatch or approved secure electronic transmission.
Typical Service Outputs
Forensic images, extractions and hash-verification records
Recovered digital data and identified artefacts
Activity timelines and incident reconstruction
Indicators of compromise and technical findings
Metadata and authenticity observations
Formal forensic reports, expert opinions and testimony
Important Service Conditions
Digital forensic services are chargeable. The applicable fee is communicated after technical evaluation and in accordance with approved RFI tariffs.
RFI accepts only requests supported by lawful authority, verified ownership, institutional authorisation or another valid legal basis.
RFI does not provide unlawful access, covert monitoring or unauthorised examination of devices, systems, accounts or data.
Chain-of-custody documentation is mandatory for criminal, judicial, regulatory and institutional investigations. Evidence receipt and handling are documented for all other services.
Clients should avoid resetting, repairing, altering or repeatedly accessing devices and digital evidence before forensic submission.
The normal service benchmark is generally seven working days under applicable SOPs, but the final turnaround depends on evidence condition, volume, encryption, urgency, complexity, technical feasibility and required review levels.
Where technical limitations prevent full recovery or analysis, RFI reports the limitations and the results achieved.
Our Commitment to Quality
Every digital forensic examination is conducted using validated methods, approved procedures, controlled access, secure evidence handling and documented chain-of-custody practices. RFI is committed to impartial, accurate, confidential and legally defensible scientific findings that support the administration of justice.
Why Choose RFI?
Experienced digital forensic specialists
Independent and impartial scientific examination
Validated forensic methods and controlled procedures
Secure evidence handling and confidentiality
RFI LIMS-supported case and evidence workflow
Formal technical review and approval process
Commitment to quality-management and international good practice
Contact and Service Request
For information on submitting digital evidence or requesting a digital forensic service, contact the Rwanda Forensic Institute through the official contact details published on rfi.gov.rw.
RFI - Advancing Justice Through Science