Practice areas
Each engagement is scoped to a question. I do not sell fishing expeditions. If the data cannot answer the question, I say so before the invoice grows.
01
Write-blocked examination of workstations, servers, and media. Copies are verified with SHA-256 and include slack, unallocated, and hidden partitions.
Acquisitions are performed through hardware or software write-blockers. I work with forensic images (E01, AFF, raw) with SHA-256 verification before and after analysis, plus a contemporaneous acquisition log.
02
Analysis of iOS and Android extractions, including Cellebrite Reader reports, covering messages, location history, app artifacts, and deleted records where the extraction and legal authority allow.
Each report is read according to its extraction type, OS version, and encryption state. Cloud-synced accounts are documented separately so the report is clear about what came from the handset versus the account.
03
A written account of what was collected, how it was collected, and what was found. I can testify to the methods I used.
The report states what was done and what was found. I will testify to my own methods, hashes, and chain of custody. I do not offer expert opinions.
04
A half-hour call to say what you have, what question you need answered, and whether this practice is the right fit.
No devices change hands on the call. It is a scope conversation for criminal defense or civil matters. It is not an expert opinion and not incident response.
Ready to scope a collection or a review?
Open intake