Ankara Digital Forensics: Court Expert, Expert Opinion, and KVKK Breach Investigation

TL;DR: DSET has provided digital forensics from its base at Ankara Hacettepe Teknokent since 2003. The team is led by Hamza Aytaç Doğanay, who served for 6 years at the Cybercrime Department of the Directorate General of Security and is a thesis-track graduate of the Ankara University Digital Forensics Master's program. The process is ISO/IEC 27037 compliant, covering both court expert work and CMK Articles 67-73 expert opinions, plus 72-hour support during KVKK breach investigations. Ankara Courthouse and the criminal and civil courts are within walking distance.

Why DSET for digital forensics in Ankara?

Ankara is Turkey's center of justice and regulation. The Court of Cassation, the Council of State, the Constitutional Court, the Department of Court Experts, and the KVKK Authority are all in Ankara. For this reason, digital forensics work carried out in Ankara demands a distinct level of care on both the technical and the legal bar.

DSET's team is led by Hamza Aytaç Doğanay. He worked for 6 years as a digital forensics expert at the Cybercrime Department of the Directorate General of Security. Over the course of that role he personally handled imaging, mobile device analysis, network traffic examination, and report writing in hundreds of criminal cases. He then completed the Ankara University Digital Forensics Master's program on the thesis track. Because his thesis dealt with the chain of custody in mobile device forensics and the current challenges encountered, there is also a deep theoretical foundation behind our mobile device cases.

The DSET office is inside Hacettepe Teknokent, in Beytepe. It is a corporate address within the university campus security corridor, where air-gapped laboratory conditions can be ensured. It is a reasonable distance from the Ankara Courthouse and the Sıhhiye and Söğütözü courthouse buildings.

Which cases do we serve?

Criminal cases

We work on bank fraud (TCK 158), unlawful access to information systems (TCK 243), unlawfully transferring or obtaining data (TCK 136), recording personal data (TCK 135), child abuse material, terrorist organization communications, and money laundering cases. The framework is the CMK: seizure, protective measures, and evaluation of evidence.

Employment law cases

Termination for just cause (4857/18), leaking of customer lists, disclosure of trade secrets, allegations involving corporate email and file movement, and examination of digital communications in mobbing claims. Expert opinion is possible on either the employer's or the employee's counsel's side.

Divorce and family law

Allegations of infidelity, concealment of assets, and analysis of digital communications in custody cases. In this area, evidence obtained through lawful means is a precondition. The details of the process are in our digital forensics process article.

Commercial disputes

Breach of contract, verification of email correspondence, validity of digital signatures, source code theft, and software license violations. Most often the question is whether the digital correspondence held by one party is genuine or has been manipulated.

Internal corporate investigations

Misconduct, insider threat, unauthorized access, and suspected intellectual property leakage. An investigation can be conducted without going to court, but because the report may later become court evidence, records are kept in compliance with ISO/IEC 27037.

KVKK breach investigation

Where a data leak is suspected, the technical determination of its scope, source, and the category of affected data. To meet the 72-hour notification obligation, the report has to be produced in time.

Post-attack forensic reporting

In ransomware, advanced persistent threat (APT), and supply chain attacks, identifying the initial entry vector, lateral movement, and data exfiltration paths. The report can be used for the insurer, the KVKK Authority, and, if necessary, the court.

Which courts do we serve in Ankara?

Within the Ankara Courthouse structure are the Ankara Heavy Penal Courts, the Ankara Criminal Courts of First Instance, the Ankara Civil Courts of First Instance, the Ankara Family Courts, the Ankara Labor Courts, the Ankara Commercial Courts of First Instance, and the Ankara Regional Court of Justice (Appeals). The court-expert appointment procedures for all of these courts run through selection from the Department of Court Experts roster. The DSET team is registered on the court-expert roster, and also fulfills expert-opinion requests obtained through the parties' counsel.

Court Expert vs Expert Opinion: which route?

Criterion Court Expert Appointment Expert Opinion
Appointed by Judge / court Party's counsel
Legal basis HMK 266, CMK 62-73 CMK 67-73, HMK 293
Fee Set by tariff Freely negotiated
Declaration of impartiality Oath Professional ethics
Evidentiary value Court evidence Court evidence
Timeline At the court's discretion Planned with the parties

The key point: both routes are valid evidence within the framework of the HMK and the CMK. For an attorney, an expert opinion for their client is a powerful tool that can move a case onto technical ground early on. The court expert acts in the role of an impartial third party.

An ISO/IEC 27037 compliant process

The international standard ISO/IEC 27037 governs the identification, collection, acquisition, and preservation of digital evidence in four stages: Identification, Collection, Acquisition, Preservation.

In the field, DSET applies this standard through the following practices:

  • Write blocker for write-protected copying of the original media.
  • Hash verification (SHA-256 at minimum, plus SHA-1 where needed) for integrity checks at every stage.
  • Tamper-evident seals for packaging evidence, with the seal number recorded on the chain of custody form.
  • Chain of custody records: who received or handed over the item, when, and under what conditions.
  • Timestamps: the start and end times of imaging are written into the record.

Thanks to this process, the report passes the test of admissibility of evidence in court.

Hamza Aytaç Doğanay's background

Hamza Aytaç Doğanay is a senior expert with more than 20 years of field experience in digital forensics and data recovery in Turkey.

  • 6 years as a digital forensics expert at the Cybercrime Department of the Directorate General of Security. During this time he handled digital evidence in hundreds of criminal cases.
  • Thesis-track graduate of the Ankara University Digital Forensics Master's program. His thesis dealt with the chain of custody in mobile device forensics and the current challenges encountered. The thesis can be found through the YÖK National Thesis Center.
  • Winner of the ACELab Greatest Data Recovery 2023 award.
  • Chief architect of KAOS, the in-house AI penetration and security engine.
  • Technical lead of the digital forensics and data recovery service DSET has run since 2003.

Expertise in mobile device forensics

Mobile devices are at the heart of today's cases. WhatsApp, Telegram, and Signal conversations, location history, photo metadata, calendar entries, and reminder records are the decisive evidence in most files.

On the mobile side, DSET uses the following tools and techniques:

  • Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective: the leading commercial forensic suites.
  • Logical extraction: application-level, fast, limited in scope.
  • File System extraction: access to the file system, far broader in scope.
  • Physical extraction: a bit-by-bit raw image, open to recovering deleted data.
  • A model-specific approach to iOS Secure Enclave and Android EDL/Download mode processes.

Hamza Aytaç Doğanay's master's thesis is directly in this area; for this reason, in mobile device cases DSET builds on both the commercial tools and the academic chain-of-custody approach that was the subject of his thesis.

The KVKK breach investigation process

Under the KVKK framework (Turkey's personal data protection law), the data controller must notify the Board within 72 hours of becoming aware of a breach. Within this window, the forensic report must answer three critical questions:

  1. Scope: how many records and which data category were affected (is any special-category data involved)?
  2. Source: how did the breach occur, and where was the initial entry point?
  3. Duration: what date range does the breach cover?

DSET has an emergency response procedure designed to produce the answers to these three questions within the standard 72-hour window. The detailed guide is in our KVKK data breach notification article.

The corporate investigation process

  1. Incident detection: a SIEM alert, an employee tip-off, a customer complaint, or an internal audit finding.
  2. Scoping: which devices, which user accounts, and which systems are suspect.
  3. Taking custody of the device: the chain of custody form is completed and the device is physically secured.
  4. Imaging: a bit-by-bit copy with a write blocker, with hash verification.
  5. Analysis: file system, logs, network traffic, and application artifacts.
  6. Reporting: objective findings, interpretation, and conclusions in separate sections.
  7. Legal process coordination: company counsel, a criminal complaint to the prosecutor's office if needed, KVKK notification, and insurance claims.

What do we offer for an attorney's client?

DSET offers law firms five separate service lines:

  1. CMK 67-73 expert opinion: at the request of defense counsel in a criminal case.
  2. HMK 293 expert view: at the request of a party's representative in a civil case.
  3. Review of the opposing party's court expert report: identifying methodological or technical errors.
  4. Reinforcement report at the Court of Cassation stage: technical justification for a request to overturn a decision.
  5. Emergency imaging following an interim injunction: on-site within 24 to 48 hours of the decision.

Physical handover in Ankara

The DSET office is on the Hacettepe Teknokent, Beytepe-Çankaya line. Access to the Ankara Courthouse, the Sıhhiye judicial corridor, and the Söğütözü corporate district is easy. Devices are received by appointment, and the initial diagnosis can be done the same day. We can also go to the field off-site (on-site imaging).

Data recovery + digital forensics, integrated

In some cases the device must be both preserved as forensic evidence and have its data recovered for business continuity. If these two processes are not managed correctly, the evidentiary value is lost. DSET delivers both disciplines under one roof: first a write-blocker image, then a recovery attempt performed on the image. The original media remains undamaged. For details, see our Ankara data recovery article.

Report format

DSET reports use a standard, court-compliant template:

  1. Title and file number (the appointing court and case number, or the attorney reference).
  2. Appointment or request (who, on what date, on what grounds).
  3. Statement of task (the technical questions posed).
  4. Methodology (ISO/IEC 27037 and NIST references, the tools and versions used).
  5. Chain of custody (chain of custody table).
  6. Findings (objective, separate from interpretation).
  7. Interpretation and conclusion (answers to the questions posed).
  8. Appendices (hash list, screenshots, log excerpts).
  9. Signature and oath declaration (if it is a court expert appointment).

Keeping the interpretation section separate from the findings section is important for the scientific quality of the report. This separation is a criterion frequently looked for in Court of Cassation reviews.

How long does it take?

  • Single-device case (phone, laptop, external disk): 1-2 weeks.
  • Corporate multi-device (5 or more devices, server, email archive): 4-8 weeks.
  • Work that requires password cracking or cloud service coordination: variable depending on the case, usually longer.

Factors that affect the timeline: number of devices, encryption status, data volume, and the requested depth of analysis.

Cost

Cost is calculated according to the complexity of the case. The first consultation is free; in this consultation the scope is assessed. An NDA is then signed, followed by a written quotation. Flexible payment models (project-based fixed fee, staged payment, retainer) are offered to suit the company's or the law firm's budget. For court expert assignments, the tariff fee applies.

KVKK and confidentiality

DSET's work is protected by three layers of confidentiality:

  • Physical security: Hacettepe Teknokent campus security and a locked in-office laboratory.
  • Logical security: an air-gapped analysis station, closed to external networks.
  • Contractual security: a mutual NDA, hash-verified handover, and data destruction in line with the NIST SP 800-88 Purge standard.

After the report is delivered to the client, DSET's working copies are destroyed in accordance with the standards within the period specified in the contract.

Frequently Asked Questions (FAQ)

Do you serve as a court expert when the court appoints you?

Yes. The DSET team is registered on the Department of Court Experts roster and accepts appointments from the competent courts in Ankara.

Can I have the opposing party's court expert report reviewed?

Yes. Under CMK 67 or HMK 293, an expert opinion can be prepared regarding the opposing party's report. This report sets out methodological errors, incomplete examinations, and faulty interpretations with technical justification.

How soon do you start after an emergency injunction?

If you have the decision in hand, an on-site visit can be planned by appointment for the same day or the next business day. Distance is not an issue for cases within Ankara.

What is the cost of obtaining a CMK 67 expert opinion?

It varies according to the scope of the case. The informative first consultation is free; at the end of it a written quotation is provided.

My company has suffered a KVKK breach, what process applies?

Notification to the Board must be made within 72 hours. DSET works to determine the scope, source, and duration within this window through emergency response.

Do you have experience on the police side?

Hamza Aytaç Doğanay served for 6 years as a digital forensics expert at the Cybercrime Department of the Directorate General of Security. The field evidence-gathering process is carried out with insider knowledge.

Can a court reject a digital forensics report?

Yes, the report can be rejected if its methodology does not comply with the standards or if the chain of custody is broken. The DSET process is specifically designed to eliminate this risk, in compliance with the ISO/IEC 27037 standard; findings are kept separate from interpretation and the chain of custody is recorded in full.

Working with DSET (Ankara office)

Address: Hacettepe Teknokent, Üniversiteler Mah. 1596. Cad. 6. AR-GE Blokları C Blok, Beytepe / Çankaya / Ankara. Phone: +90 536 662 38 09 Email: [email protected]

The process works like this: an appointment-based consultation, the signing of an NDA, a written quotation, acceptance, and the start of the work. The first consultation is free.

Our related resources:

Sources: ISO/IEC 27037, CMK, HMK, KVKK, Department of Court Experts