Device Forensics
If the evidence in your case is on a phone or computer, or sitting in an online account, we can examine it. Every step is documented, so if the other side questions how the data was handled, the record answers the question.
What we examine
- iPhone and Android devices, including iOS backups
- Windows and Mac computers
- Forensic images (E01, raw, AFF4) and virtual disks
- Messages, call logs, and contacts
- Location history and media metadata
- Browser history and app databases
- Deleted records, where they can be recovered
- Cloud and online accounts, with proper authorization
What it's used for
- Civil litigation. Business disputes, employee departures, trade secret and IP matters, and family law cases where messages or files are at issue.
- Criminal matters. Independent review for counsel of the phone and computer evidence the other side intends to rely on.
- Internal investigations. Company laptops and phones in misconduct, fraud, or data-loss inquiries.
- Harassment and threats. Preserving and analyzing messages and accounts when a client is being targeted.
How we work
Every item is hashed when we receive it and checked against that hash each time it is opened. Each access is written to a custody ledger in Bloodhound, the forensics platform we built. Every entry is linked to the one before it, so a change to any record would show up as a break in the chain.
One timeline is built across all the devices in a matter, so a conversation that moves from text to an app to email can be followed in order. The report is plain about where the data runs out and which questions it can't answer. The full custody record is attached.
Lawful access only
We examine devices and accounts that our client owns, controls, or has legal authority to have examined, such as through consent, a court order, or discovery. We do not break into anyone else's phone or account.
Device forensics: common questions
Can you recover deleted text messages?
Often, yes. Deleted messages on iPhones and Android phones can sometimes be recovered from the phone's databases and backups, but it depends on the device, its age, and how much it has been used since. We tell you what was recovered and what couldn't be.
Can you examine a phone that belongs to someone else?
Only with legal authority to do so, such as the owner's consent, a court order, or a discovery agreement. We do not break into phones or accounts that our client doesn't own or control.
How do you protect chain of custody?
Every item is hashed when we receive it and checked against that hash each time it is opened. Each access is recorded in a ledger in our Bloodhound platform where every entry is cryptographically linked to the one before, so any change would be visible.
What does device forensics cost?
It is quoted per matter after intake, based on the number of devices, the type of data, and what you need to know. You get the quote before any work starts.
Have a device that matters to your case?
Tell us what the device is and what you need from it. You'll have a quote before we touch it.