Computer forensics with a chain of custody that holds up in court
Civil litigation, internal investigations, insurance claims, regulatory matters. Court-tested examiners with EnCase, FTK, Magnet Axiom, and Cellebrite. Sworn declarations, deposition support, expert witness testimony when it goes to trial.
We can issue a written hold notice and deploy remote agents.
Three engagement shapes. One forensic standard. Pricing that doesn't change after acceptance.
A flat-fee single-device exam for HR or insurance work. Per-device pricing for larger investigations with timeline analysis. Custom litigation support when you need eDiscovery, depositions, and trial testimony. Every tier follows the same SWGDE and NIST SP 800-86 acquisition standards, with the same chain-of-custody discipline.
- Forensic image with verified MD5 + SHA-256 hashes
- Targeted exam scoped to your specific questions
- Written report (typically 8 to 16 pages) suitable for HR action or insurance claim
- Sworn affidavit attesting to methodology and findings
- Original device returned with hash-verified copy retained for 7 years
- Up to 1 hour of follow-up call with examiner included
- Forensic imaging of all in-scope endpoints, mobile devices, and cloud accounts
- Cross-device timeline analysis with synchronized event correlation
- Keyword and pattern searches with documented protocol
- Sworn declarations ready for filing in support of motions
- Examiner availability for one deposition included
- Project lead with weekly status calls until report delivery
- Everything in Multi-Device Investigation
- FRCP Rule 26(f) consultation and ESI protocol drafting
- Relativity, Reveal, or Nuix-hosted review platform with hosting included
- Expert witness reports under FRE 702 with full Daubert/Frye briefing support
- Deposition and trial testimony by an examiner
- Mock-cross preparation sessions before testimony
What it actually looks like for the seven engagement types we run most often.
These are the patterns we see week in, week out. Pricing scales from the Single-Device flat fee for the simplest matters up through Litigation Support custom pricing for full trial work.
| Matter type | Typical evidence | Deliverable | Timeline |
|---|---|---|---|
| Civil litigation | Workstations, phones, cloud accounts (M365, Google Workspace, Slack) | Sworn report + deposition support | 4 to 8 weeks |
| Insider investigation | Employee device, email, USB activity, browser history | Written findings memo | 2 to 4 weeks |
| Insurance claim | Ransomware-encrypted drives, log files, backup metadata | Chain-of-custody report for carrier | 2 to 3 weeks |
| Wage / hour / non-compete | Laptop, USB activity, cloud sync logs, after-hours timestamps | Sworn declaration for filing | 3 to 5 weeks |
| Regulatory matter | Full-disk images, log files, communications archives | Regulator-formatted report (HHS, SEC, state AG) | 6 to 10 weeks |
| Criminal defense | Full-disk imaging, mobile device imaging, cloud account preservation | Expert witness report + trial testimony | 8 to 16 weeks |
| IP theft | Workstation, email, cloud accounts, version control, build artifacts | Detailed timeline + expert testimony | 4 to 8 weeks |
For matters where evidence is at imminent risk of destruction, we offer preservation engagements. Call (888) 574-5120 directly.
The acronyms judges, opposing counsel, and regulators actually look at.
Forensic work that doesn't survive cross-examination is worse than no work at all. Every report we deliver is built on the standards below.
Honest answers.
Will your reports actually hold up in court?
Yes. Our examiners follow SWGDE and NIST SP 800-86 acquisition standards.
Every action against evidence is logged with cryptographic hashes (MD5 + SHA-256), examiner signatures, and timestamped custody transfers. Pre-engagement CVs are available so opposing counsel can vet our credentials before deposition.
Can you handle cloud accounts (M365, Google Workspace, Slack)?
Yes. Cloud forensics is a major and growing share of our work. We pull defensible exports from Microsoft 365 (mailboxes, OneDrive, Teams, SharePoint, M365 audit log, Purview eDiscovery), Google Workspace (Gmail, Drive, Vault), Slack (full workspace exports under enterprise agreement), Dropbox, Box, GitHub, and most major SaaS platforms.
We use Magnet Axiom Cyber as our primary unified cloud collection tool, with Cellebrite Cloud and the native vendor tools as cross-checks. All outputs are hash-verified and produced under chain-of-custody documentation that matches our physical-device workflow.
Do you provide expert witness testimony?
Yes. We provide pre-engagement CVs for vetting, work directly with retaining counsel on declaration drafting, and prepare for depositions and trials with full mock-cross sessions.
Daubert/Frye briefing materials available on request. We can also provide rebuttal-expert services if opposing counsel has retained their own forensic examiner and you need a credentialed second opinion on their methodology.
What if we need to act today before evidence is destroyed?
Call (888) 574-5120 immediately. We can issue a written preservation hold notice, deploy remote agents (Magnet Outrider, Velociraptor) to capture volatile data, and dispatch an examiner for physical imaging.
Evidence destruction (whether deliberate, routine spoliation, or innocent rotation of laptops) is the most common reason a case falls apart. Acting in the first 24 hours dramatically changes what's recoverable. If counsel is not yet engaged, we can operate under a preservation-only retainer until counsel is in place.
Don't let evidence walk out the door.
The best forensic work in the world cannot recover what was wiped, factory-reset, or rotated out of a backup window. If you suspect evidence is at risk, the first 24 hours are the difference between a winnable matter and a stalled one. We can issue a written preservation hold notice and have remote acquisition agents deployed.