Independent evidence intelligence
Grounded in the artifact. Oriented toward the truth.
Zemi North brings digital forensic investigations and AI assurance under one evidence-led discipline: preserve the record, test its meaning, and state only what the evidence supports.
- Practice
- Independent
- Discipline
- Evidence-led
- Accountability
- Human
DISCIPLINED EXAMINATION
DISCIPLINED EXAMINATION
APPLICATION / EVIDENCE PRACTICE
- Preserve the record
- Test its meaning
- Bound the finding
The artifact preserves what happened. Disciplined examination establishes direction.
LEAD EXAMINER / RECORDKW / 20+
Kevin V.
Watson
Founder and principal examiner
PolicingDigital forensicsTechnology leadershipApplied AI
Full professional profile ↗
Experience behind the work
Judgment remains accountable to a person.
Kevin’s background spans policing, digital forensic investigation, fraud and forensic leadership, enterprise incident response, information technology leadership, and applied AI. That combination supports work at the point where technical evidence becomes an organizational, legal, or governance decision.
20+Years across investigation, forensics, and technology leadership
GCFE · MCFE · EnCE · ITIL · MBAForensic, investigative, technology-service, and management credentials
AI / CURRENTGraduate study, hands-on deployment, and governance analysis
AI-assisted, never AI-decided. Automation may support retrieval, correlation, and pattern proposal on approved infrastructure. It does not adjudicate the evidence or sign the report.
Why Zemi North?
The artifact and the orientation.
Zemi North is built around an idea that connects heritage, evidence, and the pursuit of truth.
Zemi draws from the Taíno concept of the zemí, associated with memory, ancestry, meaning, and enduring presence. Often given physical form through objects and artifacts, the zemí carried significance beyond the object itself.
Digital investigations are built on artifacts. A file, log entry, message, timestamp, device, or fragment of network activity may appear ordinary in isolation. Properly preserved, examined, and placed in context, however, those artifacts can retain the memory of an event. They help reconstruct what happened, distinguish observation from assumption, and support conclusions grounded in evidence.
North represents orientation.
True north is a fixed point of reference, something by which direction can be established when the path itself is uncertain. Evidence serves a similar purpose. Investigations often begin with incomplete information, competing accounts, assumptions, or unanswered questions. The task is not to make the evidence support a preferred conclusion, but to allow the evidence to establish direction.
There is also a quieter geographic meaning within the name. Zemi North carries a Caribbean influence into a Canadian practice, reflecting part of the heritage from which the firm emerged without defining the limits of where it belongs or whom it serves.
The name records both commitments: respect the artifact, and follow the evidence wherever it leads.
Artifact, evidence, and memory
A physical or digital artifact can preserve the memory of an event when its provenance, integrity, and context are established.
Orientation under uncertainty
Evidence establishes direction. The record is followed rather than forced toward a preferred account.
ZEMI NORTH
Grounded in the artifact
Oriented toward conclusions that are clear, bounded, and able to withstand scrutiny.
Why the firm exists
Evidence does not interpret itself.
Digital evidence now comes from devices, infrastructure, cloud services, AI systems, generated media, and the people who configure and use them. The technical record is only useful when it can be connected to the question an organization must answer.
Digital forensic investigationsDetermine what happened and show how the evidence supports the conclusion.Explore investigations
Independent AI assuranceExamine AI systems, AI-assisted decisions, incidents, and the controls surrounding them.Explore AI assurance
Organizational trainingBuild practical forensic capability before evidence is under pressure.Explore private training
Work shown in context
See how the reasoning is applied.
These published examples demonstrate the examination approach. They are identified by source type and do not represent undisclosed client engagements.
AI-enabled ransomware reconstruction
- Question
- How can an investigation reconstruct an attack chain when an AI model contributes code or operational guidance?
- Evidence
- A controlled scenario involving prompts, model responses, generated code, execution records, and volatile artifacts.
- Demonstrates
- Separation of model contribution, human authorization, technical execution, attribution, and unresolved gaps.
- Limitation
- This is a synthetic teaching and research scenario, not a client matter or empirical validation of the method.
The Replit deletion evidence problem
- Question
- What does the public record establish about an AI-mediated deletion, and what remains unproven?
- Evidence
- Public reporting and available statements about the incident, assessed within their provenance and completeness limits.
- Demonstrates
- How event truth, technical execution, authorization, intent, and accountability remain separate analytical questions.
- Limitation
- The analysis is confined to the public record and does not claim access to the underlying systems or complete incident evidence.
Vendor deletion certification
- Question
- What can a deletion certification establish, and what supporting records are needed before relying on it?
- Evidence
- A controlled evidence problem involving a vendor assertion, its supporting record, and the boundaries of independent corroboration.
- Demonstrates
- Application of the Zemi Method from authority and question framing through corroboration, adjudication, and reporting.
- Limitation
- This is a published methodology example. It is not a representation of a client engagement or a certification issued by Zemi North.
Operating principles
How the work is conducted.
Independence
The conclusion is not selected in advance. Scope, assumptions, conflicts, and limitations are made visible.
Traceability
A reviewer can follow the path from source artifact to observation, analysis, and finding.
Proportionality
The strength of the language is bounded by the quality, completeness, and relevance of the evidence.
Human accountability
AI may assist approved tasks. A person owns every conclusion and remains able to explain it under challenge.
Initial enquiry / non-confidential
Bring us the question the evidence needs to answer.
Begin with the general nature of the matter. Evidence transfer follows conflict, authority, and scope checks.
Independent evidence intelligenceStart an enquiry