What kind of matter is this
Find the row that sounds like your week. Each one says what digital evidence can usually establish, what it cannot, and what to preserve today.
- Document
- WW-F-016
- Version
- 1.0
- Issued
- 2026-09-12
- Last revised
- 2026-09-12
- Scope
- Matter types and what evidence can answer
- Authority
- Principal
Start from the situation
Nobody wakes up needing "targeted artefact collection". They wake up because a laptop goes back to IT tomorrow, or a server is encrypted. If no row fits, ring me: the call is free, including the one where I say you do not need an examiner.
What it costs: the scoping call is free, examination $425/hr against a ceiling you authorise, a first device image $950 (≤2 TB). Full schedule on rates.
Matrimonial and family
Authority first, and it protects you more than me. I touch no device, account or mailbox without documented authority from someone entitled to give it. A saved session on a shared laptop is not authority. A password your spouse once told you is not authority. Marriage is not authority.
Unlawfully obtained material is not merely excluded: it can taint the case, create a counterclaim, and in some circumstances accessing an account you are not entitled to access is a federal offence. What is left usually covers it:
| What you want to know | What I can usually establish | Does not establish |
|---|---|---|
| Whether assets have been moved or hidden | Dated documents, statements and communications on devices and accounts you are entitled to; deleted and superseded versions where the medium allows. | An account nobody disclosed. That is what subpoenas are for. |
| What was said, and when | Messages, mail and call records from lawfully held devices, built into a timeline the other side can test. | That a particular person typed it. A device is not a person. |
| Whether a device was wiped before handover | Reinstall dates, wipe artefacts, and the gap between last use and the state I received it in. | Why. Intent is the court's finding, not mine. |
| Whether a phone is tracked, or carries stalkerware | Installed applications, profiles, device management and permissions on a handset you control. | Who installed it, unless the artefacts happen to say. |
| What a court has ordered produced | Preservation and production of exactly what the order covers, with the custody record that makes it usable. | Anything outside the order. Over-collection here is a problem. |
You end up holding the image, the exhibit set and a written report with its limits stated. Instructed through counsel wherever possible: the work is more useful under privilege.
An employee is leaving, or has already gone
Take the laptop out of the return queue today, and do not boot it. Booting alters thousands of timestamps, can trigger a cloud sync that deletes the files you are asking about, and on a managed device can trigger a remote wipe. Label it, log who holds it, leave it off. Hold the mailbox, cloud drive and home directory too — all three delete on a timer.
Nobody's fault: IT reimages on Thursday, the offboarding script runs on day thirty, and none of it reverses.
| The question | Where the answer lives | Does not establish |
|---|---|---|
| Was a USB drive connected, and when | Registry device keys and setup logs: make, serial, first and last connection. | That anything was copied to it. Connection is not copying. |
| Were files copied to removable media | The change journal, link files, recent items and shellbags, read together. | Certainty from one artefact. A copy finding needs several. |
| Were files sent to personal mail or cloud | Mail logs, browser history, download records, and sync client logs where one was installed. | What was inside an attachment the mail system no longer holds. |
| Was anything deleted before handover | Deletion artefacts, recycle bin records, and shadow copies where they survive. | Whether it was deliberate. |
| Did they take the client list | Access and export events in CRM or file server logs — the better evidence, usually forgotten. | What they remember. No disk reaches what is in a head. |
Do not tip them off, and know what does the tipping. An abrupt account disable, a device recall, a new block on something they use daily. When the person is told is for counsel and HR, not for me.
Often the artefacts show ordinary behaviour that looks alarming only because you went looking. If so, I say so and the engagement ends.
Employment disputes
The evidence is mail, chat and access logs on systems the employer controls, so the question is not recovery but "was it preserved, and can it be produced defensibly".
For an employer, the risk is deleting something after a duty to preserve attached. For an individual, it is material ageing out on a system you do not control. Either way the first step is a preservation letter and a hold, not an examination.
Where a matter requires a certification, an accreditation or a licence I do not hold, I say so at scoping, name it in the engagement letter, and either bring in someone who holds it or decline.
Business and partnership disputes
The systems are shared, so "who can authorise an examination of this mailbox" is a live question, and getting it wrong contaminates the work.
I want it settled in writing before I touch anything, and would rather lose the instruction than proceed on an assurance. Where the entity is the client, that is usually clean. Where one individual instructs about a system the entity controls, it usually is not.
Harassment, threats and stalking
Attribution from content alone is often impossible; what breaks these cases is a subpoena to a platform or a carrier, which your lawyer obtains.
I preserve the material so the subpoena has something to point at, in a form the police or a court will accept, and tell you which routes have a chance of working. If you are in danger, police first and me second.
Estate and probate disputes
A will that may have been altered, transfers in the months before a death. The work is the same as anywhere else; authority differs, because the person who could have authorised access is dead. The executor or administrator is usually the only right source.
Ask me before the family tries the passcode. Repeated guesses lock some devices permanently, and a few wipe.
What holds in all of them
Authority before access. Preserve before you examine. Limits stated alongside the finding. And sometimes the evidence cannot settle the question — a real answer, better in week one than week six.
Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem, what it would cost, and what to preserve today.