Photograph
Field documentation
An observation log with time stamps. A gap in the log is the first thing cross-examination looks for — so continuity matters as much as the image.
What happened,who was involved,and what can be proved.
A private investigations firm working alongside general counsel, audit committees and outside law firms. Corporate fraud, asset tracing, due diligence and digital forensics — from Tel Aviv, New York and Los Angeles.
The first conversation is confidential, even if we don't take the file.
- Internal investigation · New York 2025 · $1.8M traced; matter settled before filing
- Post-judgment enforcement · SDNY 2025 · Three properties worth $6.4M identified and restrained
- Due diligence · Los Angeles 2024 · The round was halted two days before signing
- Digital forensics · Los Angeles 2024 · The deletion itself became the central evidence
When people call us
If one of these sounds familiar, you are in the right place
An employee is taking money, and we don't know for how long or how much
Corporate Fraud →There is a judgment, and the debtor says he owns nothing
Asset Tracing →Before an investment or a merger — who the counterparty actually is
Due Diligence →Someone is breaching a non-compete, and we need to prove it
Surveillance →An employee left with files and returned a wiped machine
Digital Forensics →A hearing is close, and material evidence is still not in hand
Litigation Support →
Not sure? That is normal — most callers don't know which discipline it falls under. That is exactly what the first conversation is for.
Who we are
Not intelligence. Evidence.
MAOZ was founded in 2007 by investigators out of financial crime units and international enforcement. The specialism is files where the information exists but is scattered — across registries, countries and languages.
The work is usually done at the direction of a law firm and under privilege. There is a single test at the end of it: a report that can be filed as it stands, and an investigator who stands behind it under oath.
- 19years
- of investigations, from both sides of the table
- 3offices
- Tel Aviv · New York · Los Angeles
- 40countries
- where material has been collected for our files
- 24/7
- open line for urgent matters, in every time zone
The first 72 hours
The order of work in the first days
This is the window that decides how much of the evidence survives at all. It is short, and most of what is done wrong in it cannot be undone later.
- 00:00
Discovery
The only rule at this stage: confront no one. An early confrontation is the most effective instruction to destroy evidence you can possibly give.
- Within 24 hours
Preservation
Disk images, mail backups, logs and access records — before a single question. A device left running overwrites data every minute.
- Within 48 hours
Scope
What exactly is examined, in which jurisdictions, and what will count as an answer. An investigation without a written question ends in a mountain of material and no conclusion.
- Day 3 onward
Collection
Registries, documents, field work and interviews — outward circle inward. Whoever is at the centre is asked last, once there is something to put in front of them.
If a matter is live right now: the open line is answered at any hour, across all three time zones. (212) 555-0142
Practice
Six disciplines, one order of work
What we investigate →Offices
Three offices, one continuous working day
When Tel Aviv closes, New York is mid-afternoon. An urgent file does not wait for anybody's morning.
Tel AvivHQ
Israel
Headquarters. Israeli casework, regional field operations, and coordination of cross-border files.
132 Menachem Begin Road, Floor 2103-710-0200[email protected]Sun–Thu, 08:00–20:00 ISTNew York
New York
Financial investigations, asset tracing, and litigation support before the federal courts.
120 Broadway, Floor 28(212) 555-0142[email protected]Mon–Fri, 09:00–18:00 ETLos Angeles
California
Intellectual property, technology due diligence, and West Coast digital forensics.
555 West 5th Street, Suite 3100(213) 555-0188[email protected]Mon–Fri, 08:00–17:00 PT
The evidence board
What goes into a file
Six kinds of finding that recur in almost every file that reaches us, and what is worth knowing about each. Scroll sideways.
Chart
Entity map
Who holds whom, through how many layers and in which country. A map that contradicts a sworn statement is usually the fastest way to undo it.
Statement
Recorded interview
Taken down in real time, signed, and kept alongside the recording. A first account is worth more than anything said about it six months later.
Document
Registry filing
Every document carries a source, a retrieval date and a means of acquisition. Without all three it is a screenshot, not evidence.
Device data
Device image
A bit-for-bit copy with a hash. What was deleted is almost always recoverable, and the deletion itself becomes a finding.
Testimony
Investigator affidavit
Who collected it, when, and by what method. Without that the evidence rests on trust — and trust is what the other side attacks.
Where the line is
Four things we do not do
A firm that will not say what it does not do sounds like a firm that does everything — which is exactly what puts a serious client off.
We do not break into accounts
There is no access here to anyone's mailbox, phone or bank account. Evidence obtained that way is inadmissible, exposes the client, and usually takes down what was lawfully collected alongside it.
We do not buy data from brokers
Grey databases sell accuracy that cannot be verified and provenance that cannot be explained. A finding whose origin we cannot state does not go into the report.
We do not pretext for documents
There are methods that produce results quickly and produce an offence with them. We work through registries, formal requests and field work from public space, under the rules of the relevant jurisdiction.
We do not promise findings
Some files end in "nothing found". We say so upfront as a possibility, and at the end we write exactly what was examined and what did not surface — because that too is an answer you can act on.
This is general information. What is permitted varies between jurisdictions, and every file is assessed on its own before work begins.
Case files
Selected engagements
See the full list →The files listed are shown without identifying details.
- Internal investigation · New York · 2025$1.8M
Vendor fraud inside a mid-market distributor
→ $1.8M traced; matter settled before filing
- Post-judgment enforcement · SDNY · 2025$6.4M
Asset tracing against a judgment debtor pleading insolvency
→ Three properties worth $6.4M identified and restrained
- Due diligence · Los Angeles · 2024
Pre-investment diligence on a Series B target
→ The round was halted two days before signing
- Digital forensics · Los Angeles · 2024812 files
Departing engineer returned a wiped device
→ The deletion itself became the central evidence
Files are shown without identifying details, with client consent. They contain no promise of a comparable outcome — and cannot: every file rests on what was found in it.
Publications
What is worth knowing before you need us
All articles →- Evidence & procedure
Cross-border evidence: what actually travels, and what does not
Material lawfully collected in one jurisdiction is not automatically usable in another. Three distinctions that decide whether your evidence survives the trip.
· 2 min read
- Due diligence
What "no adverse findings" actually means
The most misread line in any diligence report. It is not a clearance, and its weight depends entirely on where the search was run.
· 2 min read
- Corporate fraud
Preserve first, ask second
The single most expensive mistake in internal investigations is confronting the subject before the evidence is secured. Here is the order that works.
· 1 min read
Frequently asked
What we get asked on the phone
Permitted: collecting information from public registries, documenting from public space, interviewing people with their consent, and obtaining documents through formal requests. Not permitted: breaking into accounts, intercepting communications, pretexting to obtain a document, or accessing protected data. The line differs between Israel, New York and California — which is why each team works to the rules of its own jurisdiction.
When it is lawfully collected and documented with a chain of custody — yes, and that is precisely what we build. Every finding carries its source, its date and how it was obtained, and the investigator who collected it can testify to it. Material obtained by means we could not explain never enters the report in the first place.
Cost follows scope: how many jurisdictions, how many registries, whether field work is required and whether testimony is needed at the end. We price in stages — scoping, collection, report — with each stage approved before it begins, and nothing billed beyond what was agreed without written approval.
A standard due diligence: five to ten business days. Asset tracing across several countries: three to six weeks. A full corporate fraud investigation: two months and up. Urgent evidence preservation begins the same day, because there every hour costs data.
Both. A substantial part of the work is done at the direction of a law firm and under privilege, which is an advantage where proceedings are likely. Where a company approaches us directly, we recommend settling the privilege framework in writing before work begins.
That is a possible outcome and we say so at the outset. The report will set out what was examined, in which sources, and what did not surface — and that is sometimes exactly the answer needed to close a decision. We do not manufacture findings to justify a file.
Yes, through a network of locally licensed investigators we have worked with for years. Management stays with us: the same log, the same documentation standard and the same report. The report states who collected each item and in which jurisdiction.
Glossary
The words that appear in the report
- Chain of custody
- The record of who held an item of evidence, when and how. One missing link is enough to exclude it.
- Disk image
- A bit-for-bit copy of a device, including deleted space. The examination is done on it, never on the original.
- Beneficial ownership
- Who actually benefits from an entity, behind the names on the register.
- PEP
- A politically exposed person. A flag that triggers enhanced checking, not an adverse finding in itself.
- Metadata
- What is stored about a file rather than inside it: who created it, when, and on which device.
- Counter-check
- Examining the opposing side's material — witnesses, experts and documents — for contradictions.
Most enquiries arrive before it is clear what needs to be examined
The first conversation exists to define the question and the scope. It is confidential and free of charge, and if we conclude we have nothing to add, we will say so.