Practice areas
Each engagement is scoped to a question. I do not sell fishing expeditions. If the data cannot answer the question, I say so before the invoice grows.
01
Write-blocked imaging of workstations, servers, and media. Copies are verified with SHA-256 and include slack, unallocated, and hidden partitions.
Acquisitions are performed through hardware or software write-blockers. I produce forensic images (E01, AFF, raw) with SHA-256 verification before and after capture, plus a contemporaneous acquisition log.
02
iOS and Android collections covering messages, location history, app artifacts, and deleted records where the device and legal authority allow.
Logical, file-system, and physical methods are selected by model, OS version, and encryption state. Cloud-synced accounts are documented separately so the report is clear about what came from the handset versus the account.
03
A verified copy of a hard drive or solid-state drive for a private individual, made without writing to the original.
The source is write-blocked. The duplicate is checked against the original with SHA-256, and the handoff is logged under the same chain of custody. This is a copy for the person who owns the drive, not an expert opinion and not incident response.
04
A written account of what was collected, how it was collected, and what was found. I can testify to the methods I used.
The report states what was done and what was found. I will testify to my own methods, hashes, and chain of custody. I do not offer expert opinions.
05
A half-hour call to say what you have, what question you need answered, and whether this practice is the right fit.
No devices change hands on the call. It is a scope conversation for criminal defense, civil matters, or a private drive copy. It is not an expert opinion and not incident response.
Ready to scope a collection or a review?
Open intake