Help for Australian individuals and families who are being targeted online. Cyberstalking, internet trolls, online defamation, cyber harassment and technology-assisted stalking are not things you have to face alone, and they can be investigated, identified and evidenced.
Simon Smith is the cyber expert behind this practice and personally conducts every engagement. He is a certified ethical hacker and certified digital forensic investigator with more than two decades of hands-on software engineering, information security and mobile device evidence experience. This practice focuses on people on the receiving end of online abuse: victims of cyberstalking and technology-assisted stalking, targets of internet trolls and coordinated online harassment, and people whose reputation is being damaged by online defamation. The work is identifying who is responsible, capturing the evidence properly, and giving you something you can act on, with national reach from a Melbourne base.
This is the evestigatorreviews.com.au property of the Simon Smith cybersecurity practice, where the same cyber investigation services are presented alongside cumulative public commentary, media appearances and client outcome summaries. The primary cybersecurity services site is at cyberexpert.com.au, and the expert witness practice for solicitors and instructing counsel is at expertwitness.com.au.
Simon Smith has operated this cybersecurity investigation practice continuously since 2015, helping people and businesses across Australia establish what actually occurred when something digital has gone wrong. The practice does not act for prosecuting authorities, does not advertise law firms as a primary audience, and is set up to reconstruct an incident from the position of the person who has been affected, whether that is a private individual being cyberstalked, a family that suspects spyware on a phone, a small business that has just been hacked, or a corporate client dealing with the aftermath of a data breach.
Simon is a Certified Ethical Hacker and Certified Hacking Forensic Investigator with the EC-Council, holds Advanced Diploma and Certificate IV qualifications in Cyber Security, and has worked across software engineering, information security and digital evidence since the late 1990s. The practice draws on a deep tooling base across mobile forensics, host forensics, network analysis, cloud account artefacts, telecommunications records and open source intelligence, and uses that base to produce factual, evidence-led conclusions rather than commercially convenient narratives.
Typical points of first contact include suspicion of spyware on an iPhone or Android handset, an account or email mailbox that has been accessed by someone who should not have access, money lost to an online scam or business email compromise, a small business website or server that has been hacked, ongoing cyberstalking and technology facilitated abuse, USB or cloud-based data theft by a departing staff member, ransomware affecting a small or medium business, or a notifiable data breach that needs to be understood and responded to under the Privacy Act.
The practice is based in Melbourne and accepts retainers nationwide. To engage Simon Smith on a matter, please use the Case Review form below or call 0410 643 121.
Each engagement begins with a scoped case review, after which Simon Smith confirms what can sensibly be investigated, what the deliverable will be, and what it will cost. The practice does not take on work it cannot honestly progress, and will say so up front if a matter is outside its scope or better directed to police or a regulator.
For individuals being targeted online, harassed across social media, monitored through their own devices, doxxed, or subjected to coordinated abuse, Simon investigates the technical surface of the conduct, traces the origin where the platform artefacts and metadata permit it, and produces a structured written summary the affected person can take to police, lawyers, schools or workplaces. Conclusions reflect what the evidence supports, rather than what the affected party may suspect.
For businesses and corporate clients that want an authentic adversary perspective on their systems, Simon performs ethical hacking engagements under written scope and rules of engagement, with explicit authorisation. The output is an executive summary, a technical findings report ranked by severity, and remediation guidance written for the engineering team that has to fix the problem rather than for marketing.
Formal penetration testing engagements are delivered against agreed scope across external network, internal network, web application and mobile application targets. The methodology follows recognised testing standards, with finding severities mapped to a CVSS style scoring approach and each finding accompanied by reproduction steps, evidence and an actionable remediation path. Suitable for SMB clients, larger corporate clients and as supplier assurance evidence for procurement.
When an Australian business has been breached, the priority is identifying what was accessed, what was taken, how the attacker got in, whether they are still inside, and what notification obligations apply under the Privacy Act and the Notifiable Data Breaches scheme. Simon assists with technical scoping of the incident, evidence preservation, root cause analysis, and the written record needed to support a clear-headed response to affected individuals, insurers and regulators.
A detailed examination of an Apple iPhone where the device owner needs to know whether the handset has been compromised, whether spyware or a mobile device management profile has been installed, whether an iCloud account has been accessed by someone else, or whether evidence relevant to family law, custody, civil disputes or workplace matters can be recovered. The examination uses recognised commercial mobile forensic platforms and produces a structured forensic report.
The Android equivalent of the iPhone examination, scoped to the make and model in question. Common deliverables include identification of unauthorised access, identification of installed stalkerware or hidden accessibility abusing applications, recovery of deleted messages and media where the underlying storage still holds the data, examination of Google account artefacts, and a written report explaining what the device actually shows.
For people who have discovered that someone has accessed their email mailbox, social media account, banking, cloud storage or work systems without permission, this engagement reconstructs how the access occurred from the artefacts that exist, identifies the windows of access, identifies any data that was viewed, exported or modified, and produces a written record suitable to support the affected person in dealing with the platform, with police, or with civil proceedings.
A broader category for individuals who have suffered a cybercrime loss, including fraud, scam loss, identity theft, deepfake harassment, sextortion, romance scam loss and investment scam loss. The practice provides a structured technical review of the incident, identifies what can practically be done at each external touchpoint such as bank, platform, registrar and regulator, and produces a written report the victim can use to escalate.
A response oriented engagement for businesses and individuals whose website, mailbox, account or server has been hacked and who need to understand the intrusion, contain ongoing access, preserve the evidence properly, and remediate the underlying weakness. Engagements run from initial triage through full forensic reconstruction depending on the severity and the client need.
The list below summarises the categories of cybersecurity and digital forensic matters this practice regularly handles. Every engagement is scoped to the actual facts of the case rather than to a generic service template.
Suspicion that a personal or business device has been compromised by an attacker, by an estranged partner, by a former employee, or by a remote intruder, and a need for a clear technical answer on whether that is the case and what was affected.
A focused forensic look at the device for indicators of stalkerware, hidden monitoring applications, abused accessibility services, mobile device management profiles installed without the owner being properly informed, or jailbreak and rooting artefacts that change what the device is actually doing.
An account such as a primary email mailbox, a social media account, a cloud storage account or an internet banking account has been accessed by someone else. The practice reconstructs the access from the artefacts available on the device and from the platform, where the user has the ability to download those records.
A romance or relationship scam loss with payments often made through bank transfers, gift cards or cryptocurrency. The practice reviews the conversation evidence, the payment trail and the platform fingerprints to produce a structured incident summary.
An attacker has gained access to a business email account, then either silently inserted themselves into a real invoice exchange to redirect funds, or impersonated a director to authorise a transfer. The practice reconstructs the intrusion, identifies the access path, and supports the business with the evidence needed to engage the bank, the insurer and the regulator.
A departing or recently departed staff member is suspected of taking confidential data with them, either by removable media, by personal cloud account or by personal email. The practice examines the device and account artefacts that survive after the person has left.
AI generated images, voice or video used to harass, intimidate or defame an identifiable individual. The practice examines the artefacts for indicators of synthetic generation, traces the upload and distribution chain where the platform permits it, and produces a written technical record for escalation.
Threats to release sensitive data, sextortion threats, ransom demands tied to alleged compromise of a device, and demands for payment in cryptocurrency. The practice assesses whether the underlying threat is real, what the practical exposure looks like, and how to respond without making the situation worse.
Practical incident response for small and medium businesses whose servers or endpoints have been encrypted by a ransomware actor. Focus is on containment, evidence preservation, identification of the strain, scope of data exfiltration, recovery planning and a clear written record for insurer and regulator dealings.
Digital evidence that arises in the context of separation, parenting matters and protection orders, examined factually and proportionately, with care taken to scope the engagement to what the affected party can lawfully obtain and present.
Since 2015 this practice has been retained on cybersecurity, digital forensic and digital evidence matters originating in every Australian state and territory and in the Commonwealth, with technical findings used by clients across private, commercial and legal contexts. The cybersecurity work draws on the same investigator, the same tooling base and the same evidentiary discipline that underpins the formal expert reporting side of the practice, but is configured for clients who are dealing with an incident rather than preparing a court case. For instructed expert witness work directed to solicitors, barristers and the courts, please see expertwitness.com.au.
Qualifications, certifications, memberships and experience of Simon Smith relied on when preparing expert reports and giving oral evidence in Australian courts and tribunals.
Simon Smith has been a published Apple App Store and Google Play Store app developer since 2016, handheld device developer since 2002.
Simon Smith has been retained as an expert witness in criminal and civil proceedings across multiple Australian state and territory jurisdictions, the Commonwealth, and New Zealand. A non-identifying summary of matters is available below for instructing solicitor reference.
Independent news articles and interviews that quote or feature Simon Smith in his capacity as a digital forensic IT investigator and cyber expert, each verified against the primary publisher. Most recent first.
Simon Smith, the digital forensics examiner and expert witness, described the "highly detailed behavioural fingerprint" that modern connected vehicles build on every driver, in coverage of the OAIC inquiries into connected car manufacturers.
Source ↗Simon Smith, acting as independent cyber expert, characterised brushing as a deceptive trade practice rather than a direct security breach and cautioned recipients about downstream identity misuse.
Source ↗Simon Smith, in his public commentary capacity, discussed Facebook Marketplace scams and deterrence measures for consumers.
Source ↗Simon Smith provided expert commentary on payee confirmation laws and on bank customer education measures in response to the ACCC Targeting Scams figures.
Source ↗Simon Smith called for payee verification, blocking of B2B-only account transfers and IP location tracking as simple bank interventions that would prevent the bulk of the scam transfers he sees across his casework.
Source ↗Simon Smith documented Australian victim losses of up to 850,000 dollars from elaborate pig butchering scams.
Source ↗Simon Smith assisted the victim with AFCA complaint preparation and cybercrime investigation support.
Source ↗Simon Smith cautioned about the accessibility of large scale SIM box equipment and its implications for telecommunications enabled fraud.
Source ↗Simon Smith described WhatsApp Hi Mum style scams as becoming a daily occurrence for Australian households.
Source ↗Simon Smith called for universal licence replacement and a centralised protection system for affected identity documents.
Source ↗Simon Smith assessed potential aggregate losses based on interviews with approximately 50 victims of the alleged travel agent fraud.
Source ↗Simon Smith was quoted on gathering technical evidence to assist Australian and international law enforcement in romance scam matters.
Source ↗Simon Smith appears in the 7NEWS Spotlight scam investigation assisting the news team in stopping a live cyber scam in action. Undated archival video file.
Source ↗Primary source for verification: SCAMAssist media index at scamassist.com.au/media.asp. Where an outlet is paywalled or the fetch layer is blocked, dates are inferred from secondary references and flagged accordingly. Additional items under review.
Short factual answers to the questions that arise most often when individuals, families and small businesses first contact the practice. Each engagement is then scoped to the actual facts.
Most legitimate iPhone compromise involves either an installed configuration profile, a shared Apple Account session, or a previously trusted computer that retains a pairing record. A forensic examination of the device and of the iCloud account artefacts the owner can lawfully download is the only reliable way to confirm or rule that out, because surface symptoms such as battery drain or heat are not diagnostic on their own.
In some scenarios yes, including via shared cloud accounts the user has forgotten about, via family sharing or screen time configurations the user did not realise were in place, via abused accessibility services on Android, or via stalkerware applications installed during a window of physical access. Whether any of those applies in a given case is an evidentiary question, not a guess.
An ethical hacking engagement begins with a written scope and rules of engagement that define which systems, accounts and techniques are in and out of bounds, then proceeds through reconnaissance, vulnerability identification, exploitation attempts within the agreed scope, and reporting. The output is a ranked findings report with reproduction steps and remediation guidance, not a marketing certificate.
The first practical steps are usually contacting the sending bank to request a recall and reporting to Scamwatch and the platform involved. Beyond that, the practice can review the technical trail of the scam, characterise the operating pattern, and produce a written record that supports any subsequent dealing with the bank, the platform, the AFCA process or police. Recovery cannot be promised and the practice does not promise it.
Do not reset, wipe or factory restore the device until the evidence has been preserved, because that destroys the artefacts a forensic examiner would otherwise rely on. Restrict physical access to the device, change the primary cloud account password from a separate trusted device, and engage a digital forensic examiner to look at the handset. The practice handles this category of work routinely.
Most Australian small business websites run on common platforms with known classes of weakness, including unpatched plugins, exposed administration interfaces and weak password reuse. A scoped penetration test or ethical hacking engagement gives a factual answer on which weaknesses your particular site has and how an attacker would actually move through them, rather than relying on automated scans alone.
Pricing and timeframe scale with the target size, the number of in scope systems, whether the engagement is external only or also internal, and the level of testing required. A small external test against a single web application typically runs across several working days. A larger engagement covering internal network, web applications and mobile applications runs longer. The practice quotes against a written scope rather than against an arbitrary number.
If you are an individual whose personal information was held by an organisation that was breached, change any passwords reused at that organisation, watch for follow on phishing or impersonation, and consider a credit ban with the major bureaus where identity grade data was disclosed. If you are the organisation that was breached, the priorities are containment, evidence preservation, scope of impact and consideration of obligations under the Notifiable Data Breaches scheme.
It depends. Whether deleted content can be recovered depends on the operating system version, the application, whether the relevant database has been overwritten, and how long ago the deletion occurred. A forensic acquisition of the device is the only way to know what is in fact still recoverable.
Yes. The practice traces the technical fingerprints of an impersonation account where the platform exposes those artefacts, reviews the content for indicators of who is behind it, and produces a written record suitable for platform escalation, lawyer correspondence or police. Some platforms cooperate with affected individuals via formal channels and the report assists those processes.
Both. The practice was deliberately built to take individual clients seriously, in particular victims of cyberstalking, account takeover, scam loss and image based abuse, alongside its corporate cybersecurity work for small and medium business clients.
No. The practice is operated as an independent technical service for affected individuals and businesses, and on the formal expert witness side at expertwitness.com.au it is most commonly retained by defence counsel, civil parties and private clients rather than by prosecuting agencies.
Appearances across Australian television, radio and podcast outlets include, including Sky News, the Nine Network (Today, Today Extra, A Current Affair), the Seven Network, the Ten Network, the ABC, SBS and on Australian radio.
Please provide enough detail for Simon Smith to understand the nature of the incident, the urgency, what has already been tried, and what kind of help is sought before any substantive discussion.
Outline the situation briefly, including when it started, what platforms or devices are involved, what evidence still exists, and what the desired outcome looks like. For sensitive or time critical situations, please email [email protected] directly rather than using the web form.
