Evidence handling
How your material is taken in, stored, released, retained and destroyed — the handling terms from the engagement letter, and what they cost.
- Document
- WW-F-010
- Version
- 1.0
- Issued
- 2026-09-11
- Last revised
- 2026-09-11
- Scope
- Custody, storage, retention, destruction
- Authority
- Principal
What it costs
Storage after close — $75 per matter per month up to 4 TB, $15/TB/month above that. The first 90 days after the final invoice are included.
Certified destruction — $150 per matter, certificate included.
A subpoena served on me — published hourly rate, written ceiling. Where notice is lawful you hear at once; whether to object or quash is counsel's call (Fed. R. Civ. P. 45(d)(2)(B) gives fourteen days).
What you get
A written chain of custody, delivered with the report. Analysis runs on a working copy; nobody works from the master image.
| Recorded | What it fixes | What this does not establish |
|---|---|---|
| Item, serial, condition; from whom and when | The item reported is the item received | That it is the only relevant device |
| Acquisition digest: tool, version, source and image hashes SHA-256 | The image matches the source, unchanged since | Who created or deleted anything; integrity is not attribution |
| Every transfer and access: who, when, which copy, why | An unbroken sequence of named hands | Admissibility; a gap goes to weight (Howard-Arias, 679 F.2d 363 (4th Cir. 1982)) |
Custody rules
- Authority first. Nothing enters custody until the authority to access it is written down. Where it is contested, I ask counsel.
- At rest. Encrypted, access-controlled, separate from other matters; I hold the keys. Access only for people named in the letter, every access logged. No third-party cloud without your written consent.
- Withdrawal. Re-hashed every time it leaves the store. On a mismatch nothing is used or produced: work stops and you hear at once.
- Subcontracting. None by default. A capability I do not hold means naming the provider and getting your written consent first.
Retention and destruction
| Stage | Period | What this does not establish |
|---|---|---|
| Included storage after close | 90 days | A retrieval-time commitment |
| Retention before destruction is proposed | 12 months | Advice on your matter |
| Notice before any destruction | 30 days | Destruction by default; silence means I keep holding |
| Unearned balance returned | 10 business days | A lien for an unpaid invoice |
Extension on written instruction at the storage rate; under a litigation hold I keep holding. Nothing is destroyed without written instruction naming the items. The signed certificate — items, digests, method, date — follows whether or not you ask, covering only the copies I held.
Suspected child sexual abuse material — work stops immediately
This rule is absolute. An engagement letter cannot vary it, and neither can an instruction, a protective order or a client's preference.
If material that appears to be child sexual abuse material is encountered at any point — in triage, during an acquisition, during examination, in a carved artefact, in a thumbnail cache — examination stops at that moment. The material is not opened further, not copied, not extracted, not exported into a report, not attached to an email, and not shown to the client. Any image or container already in my custody is isolated and secured in place. I then contact the retaining party's counsel and, on counsel's instruction and without avoidable delay, law enforcement.
Knowing possession is itself an offence under 18 U.S.C. § 2252 and § 2252A, and there is no forensic exception for a private examiner. Copying it to preserve it. Viewing more of it to be sure. Carrying it to another facility to look at it properly. Each of those is an independently unlawful act.
In federal criminal matters, 18 U.S.C. § 3509(m) keeps such material with the Government or the court, inspected at a Government facility. The route runs through counsel and the court, not a copy in my store. If the rule engages mid-matter, work stops and the engagement may end there.
Where these terms sit
Where these terms and a signed letter differ, the letter governs.
Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem, and what holding your material costs.