Incident in progress What to do in the first hour → Preserve first. Several ordinary responses destroy the evidence permanently.
Wirewalk Forensics and Security

Evidence handling

How your material is taken in, stored, released, retained and destroyed — the handling terms from the engagement letter, and what they cost.

Document
WW-F-010
Version
1.0
Issued
2026-09-11
Last revised
2026-09-11
Scope
Custody, storage, retention, destruction
Authority
Principal
These are the terms in the engagement letter; they govern from signature. If your policy needs something else — shorter retention, your own key — say so at scoping. It gets written in, or I decline.

What it costs

Storage after close$75 per matter per month up to 4 TB, $15/TB/month above that. The first 90 days after the final invoice are included.

Certified destruction$150 per matter, certificate included.

A subpoena served on me — published hourly rate, written ceiling. Where notice is lawful you hear at once; whether to object or quash is counsel's call (Fed. R. Civ. P. 45(d)(2)(B) gives fourteen days).

What you get

A written chain of custody, delivered with the report. Analysis runs on a working copy; nobody works from the master image.

The custody record
Recorded What it fixes What this does not establish
Item, serial, condition; from whom and when The item reported is the item received That it is the only relevant device
Acquisition digest: tool, version, source and image hashes SHA-256 The image matches the source, unchanged since Who created or deleted anything; integrity is not attribution
Every transfer and access: who, when, which copy, why An unbroken sequence of named hands Admissibility; a gap goes to weight (Howard-Arias, 679 F.2d 363 (4th Cir. 1982))

Custody rules

  • Authority first. Nothing enters custody until the authority to access it is written down. Where it is contested, I ask counsel.
  • At rest. Encrypted, access-controlled, separate from other matters; I hold the keys. Access only for people named in the letter, every access logged. No third-party cloud without your written consent.
  • Withdrawal. Re-hashed every time it leaves the store. On a mismatch nothing is used or produced: work stops and you hear at once.
  • Subcontracting. None by default. A capability I do not hold means naming the provider and getting your written consent first.

Retention and destruction

Defaults, from the final invoice
Stage Period What this does not establish
Included storage after close 90 days A retrieval-time commitment
Retention before destruction is proposed 12 months Advice on your matter
Notice before any destruction 30 days Destruction by default; silence means I keep holding
Unearned balance returned 10 business days A lien for an unpaid invoice

Extension on written instruction at the storage rate; under a litigation hold I keep holding. Nothing is destroyed without written instruction naming the items. The signed certificate — items, digests, method, date — follows whether or not you ask, covering only the copies I held.

Suspected child sexual abuse material — work stops immediately

This rule is absolute. An engagement letter cannot vary it, and neither can an instruction, a protective order or a client's preference.

If material that appears to be child sexual abuse material is encountered at any point — in triage, during an acquisition, during examination, in a carved artefact, in a thumbnail cache — examination stops at that moment. The material is not opened further, not copied, not extracted, not exported into a report, not attached to an email, and not shown to the client. Any image or container already in my custody is isolated and secured in place. I then contact the retaining party's counsel and, on counsel's instruction and without avoidable delay, law enforcement.

Knowing possession is itself an offence under 18 U.S.C. § 2252 and § 2252A, and there is no forensic exception for a private examiner. Copying it to preserve it. Viewing more of it to be sure. Carrying it to another facility to look at it properly. Each of those is an independently unlawful act.

In federal criminal matters, 18 U.S.C. § 3509(m) keeps such material with the Government or the court, inspected at a Government facility. The route runs through counsel and the court, not a copy in my store. If the rule engages mid-matter, work stops and the engagement may end there.

Where these terms sit

Where these terms and a signed letter differ, the letter governs.

Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem, and what holding your material costs.