About Elusive Data
Elusive Data is a Swedish digital forensics company building specialist software and practical training for the work that follows extraction. We help forensic professionals reduce the risk of missed or misinterpreted app evidence by giving them better ways to examine underlying data, test important interpretations and explain what their findings support.
Our software complements the forensic platforms teams already use. Our training develops the knowledge needed to work with the source when a decoded view is incomplete, unsupported, conflicting or requires closer examination.
Why we exist
Extraction tools give investigators essential access to digital evidence. But applications change, data structures evolve and parser support varies between tools and versions. A decoded view can show what the parser surfaced without showing what may have been missed or whether an important result was interpreted correctly.
Elusive Data was built around that gap. We focus on the point where the examiner needs to continue: into the database, supporting files, surrounding structure and underlying bytes that can help establish what the data actually supports.
What we do
The product and the knowledge must work together. One provides access and context. The other develops the judgment required to interpret the evidence responsibly.
Firefly provides one workspace for app-data investigations after extraction. Examiners can recover, interpret, validate and report data across supported sources while keeping the analysis connected to the underlying files.
Discover FireflyOur instructor-led and Guided On-Demand courses help investigators understand how data is stored, changed, recovered, interpreted and validated. Learning moves from explanation into realistic files, exercises and investigative decisions.
Explore trainingOur forensic platform
Firefly is not an extraction platform and it is not intended to replace the tools a laboratory already relies on. It adds a specialist environment for examining app databases and supporting files when the standard decoded result is not enough.
Continue when an app or relevant structure is unsupported.
Examine recoverable historical or deleted material where usable data remains.
Test important interpretations against source context and underlying data.
Keep recovery, interpretation, validation and reporting in one workflow.
Firefly complements the forensic tools already in the laboratory and gives examiners a direct way to work with underlying app data across supported sources.
How we work
We design around the examiner’s need to understand where a result came from, what it means and what can responsibly be concluded from it.
Analysis should retain a clear path back to the underlying data wherever the source and method support it.
Software provides access and context. The examiner remains responsible for interpretation and conclusion.
Tools and training are shaped around real investigative questions, review and report-ready explanation.
Our software and methods strengthen existing forensic workflows rather than requiring teams to replace them.
Experience behind the work
Co-Founder and Head of Product and Training
James’s background spans law enforcement casework, mobile device investigations, advanced forensic training and the development of software for forensic professionals. His work connects technical depth with a practical question: how can an examiner understand the underlying data well enough to recover, test and explain an important finding?
That perspective shapes both Firefly and Elusive Data’s training. Feedback from investigators, laboratories, public-sector organizations and forensic teams continues to guide what we build and teach next.
Elusive Data is based in Stockholm, Sweden, and works with forensic professionals and organizations internationally.
Connect with James on LinkedInWho we support
The operating environment may differ, but the need is consistent: important app evidence must be examined carefully, explained clearly and reviewed with confidence.
For law enforcement, forensic laboratories and justice organizations examining mobile and app-based evidence.
For DFIR, eDiscovery, consulting and private laboratory teams that need specialist app-data capability.
For organizations that require controlled, source-connected examination in demanding or disconnected environments.
Talk with Elusive Data
Explore Firefly, develop your team’s forensic skills or talk with us about the app-data challenges your organization is working through.
