Wirewalk Forensics and Security

Digital forensics, incident response and litigation support in the New York area. One principal. The rate is published, the method is published, and the limits of a finding are written down before the engagement rather than on the stand.

Document: WW-F-001
Version: 1.1
Issued: 2026-09-11
Last revised: 2026-09-17
Scope: Practice statement and refusals
Authority: Principal

917-217-7975 If I cannot take it, I say so on the call. I got hacked. Help me now Ransomware, an encrypted system, an intruder still inside. Money has gone out A fraudulent wire or a compromised mailbox. The money clock is shorter. Protect the evidence first Before anyone reboots, rebuilds or restores. That destroys the record. Someone is leaving with data A laptop in the return queue, a mailbox on a deletion timer. It is a legal matter, not an incident Divorce, employment, a partnership dispute, harassment, an estate. Nothing has happened. Keep it that way Securing the business, and proving what happened if it does.

What I do

I image and examine computers, phones and cloud accounts, run incident response for businesses without an incident response team, answer the other side's expert report, and handle eDiscovery.

You end up holding a report carrying tool, version and hash record, a verified image with its custody record, or a declaration — see the specimen report.

Where a matter needs a certified examiner or a venue license, the engagement letter names it: I bring someone in, or I decline.

What it costs

Opening figures
Item	Price	What this does not establish
Scoping and preservation call, 45 minutes	No charge	An engagement. Conflicts clear first.
Examination and analysis, hourly	$425/hr	A total. Hours run against a ceiling you authorize.
Images, verified copies, hash sets	Fixed price	Analysis. Defined extent only.

Same rate whichever side retains me, and whether or not the answer helps you. At 80% of your ceiling I stop and report, and do not resume without a written increase. Full schedule on rates.

How to start

Call 917-217-7975 with the parties' names, the question, the deadline and a number. Do not send case material or privileged facts until conflicts have cleared.

Then a conflicts check, an engagement letter, and an authorization with a ceiling. Money paid earlier is held unapplied and refunded in full. Terms on engagement.

What I will not do

Each is a term in the engagement letter.

I will not

Take a fee that moves with what I find, the outcome, or which side retains me.
Take or pay a referral fee, take a vendor commission, or sell the remediation I investigated.
Write to a conclusion supplied in advance, or report an inference as a finding.
Say who was at the keyboard from device evidence alone. A device is not a person.
Opine that a party intended to destroy evidence. Intent is the court's finding.
Bill above your written ceiling, or run an uncapped password or extraction attempt.
Carry an overage or surge rate; hours past a standby credit bill at the retained rate.
Deduct card processing fees from a balance I am returning.
Image a whole disk where a targeted collection answers it, or bill for volume I expanded.
Stay quiet when culling would take your bill from five figures to four.
Touch a device, mailbox or account without documented authority — a spouse's phone included.
Start work, hold a date or take a file before conflicts clear and the letter is signed.
Take a matter I cannot finish by your deadline, or one needing a license I lack.
Act for both sides, or as a neutral where I have advised either side.
Promise a finding, a recovered file, an unlocked handset, or that anything I produce will be admitted.

Call me

917-217-7975 — one examiner, a published rate, a free first call even when the data cannot answer your question.

Start a scoping call Rate schedule Something is happening now

Also: roles, standby, evidence handling, eDiscovery, versions.