Digital Forensics
Digital forensics is the process of identifying, preserving, and analyzing electronic evidence from computers, phones, and storage devices. The goal is to determine what happened and document it in a clear, defensible way.
Attorneys
Divorce, custody, civil matters, employee issues, and cases where digital evidence may be used in court. Proper preservation and documentation matters from the start.
Businesses
Internal investigations, misuse of company systems, suspected data theft, policy violations, and incident response support.
Individuals
Situations where you need clarity from a device, including hidden communications, deleted items, or activity that does not line up with what you have been told.
Private Investigators
Examination and reporting support when digital evidence is part of a broader investigation.
How the Process Works
1. Forensic imaging
A verified forensic copy of the media is created so analysis is performed without altering the original device.
2. Examination and analysis
Artifacts are identified, timelines are built, and relevant data is recovered and interpreted using forensic methods.
3. Reporting
Findings are documented in a report that explains what was found and how the conclusions were reached.
Why Digital Evidence Must Be Handled Carefully
Digital information can be altered unintentionally with normal device use. Opening files, installing software, or simply starting a computer can modify timestamps and system artifacts that may matter later.
Because of this, forensic work typically starts with a verified forensic image so analysis can be done on a working copy while preserving the original media.
Important, What Not To Do
* Do not install cleanup tools or recovery software.
* Do not reset the device or reinstall the operating system.
* Do not explore the device trying to find the evidence yourself.
* Do not delete anything or attempt to hide activity.
Preserving the device first often matters more than people realize.
Example Digital Forensics Scenarios
* Divorce or custody matter involving communications and device activity
* Employee misconduct investigation involving file access and data transfer artifacts
* Recovered deleted financial records and reconstructed activity timelines
* Timeline reconstruction to determine what happened during a specific time window
* Internet activity review to identify patterns relevant to the case
* External storage device activity showing file movement and copying
These examples are generalized and do not represent any specific client.
Questions Attorneys Often Ask
* Will the evidence be preserved properly, and can the steps be explained later
* Can deleted information actually be recovered, and what affects the odds
* How will the findings be documented, and what will the report include
* Can the findings be explained in deposition or court in a way that makes sense to non technical people
Pricing and Up Front Costs
Retainer
$1000 retainer is due upon agreement. The retainer is applied to the final invoice.
The retainer covers initial intake, forensic imaging preparation, initial testing, initial research, and case planning.
Forensic work and reporting
$225 per hour for forensic analysis, documentation, and report preparation.
Consultation after the initial discussion is billed at the same hourly rate.
Testimony and court related time
$2000 per day for deposition, court, or stand by status, or any part of a day.
Trial and testimony preparation is billed at $225 per hour.
Travel
$100 per hour travel time.
Mileage billed at the current IRS business rate, plus tolls and parking.
Storage media
If the client does not provide an external drive, an external storage device is provided for $200 to deliver recovered data and reports.
If you email the situation and what devices are involved, I will respond with what is realistic, what the next step looks like, and what the retainer will cover for your specific case.
Start With an Email
Include the device type, what you are trying to determine, and any deadlines. I will respond with the best next step.
