Rate schedule
The whole schedule, published before either of us has said a word about your matter. Same rate whichever side retains me, and the same whether what I find helps you or ruins your week.
- Document
- WW-F-004
- Version
- 1.0
- Issued
- 2026-09-11
- Last revised
- 2026-09-11
- Scope
- Published fees and price classes
- Authority
- Principal
Hourly
| Line | Rate |
|---|---|
| Principal — examination, analysis, opinion | $425/hr |
| Associate examiner, under my directiononly where one is engaged; the letter says so. I sign either way | $275/hr |
| Collection and processing technicianas above, and never opinion work | $175/hr |
| eDiscovery project management | $180/hr |
| Travel, capped at 5 hours daily | $210/hr |
| Billing increment, one task an entry | 0.1 hr |
Examination is hourly against a written ceiling: I stop and report at 80%, and bill no hour above it. Expenses at cost, no mark-up.
One uplift, +35%: hours outside 08:00–18:00 Eastern weekdays, weekends and federal holidays, or out-of-hours work starting within 24 hours of signature. Those hours only, not the matter.
Your rate is the one on your engagement letter — held 12 months, changed on 60 days' notice. Old schedules at versions.
Acquisition and collection
You hold the image, its hashes, the worksheet and a signed chain of custody. Write-blocked, SHA-256 verified twice.
| Service | Unit | Price | Does not establish |
|---|---|---|---|
| Scoping and preservation call, 45 minutes | per matter | No charge | Nothing examined, nothing found. |
| Forensic image: computer, drive or external media, 90 days storage | per device | $950 ≤2 TB $1,450 2–8 TB $650 further device, same site and day above 8 TB quoted | Speaks to the copy, not the source. |
| Targeted collection, with a note of what I did not take | per endpoint | $475 | No unallocated space, no deleted content. |
| On-site collection, up to 8 hours within 60 miles | per examiner-day | $2,900 $1,700 half-day | Access and encryption decide what is collectable. |
| Remote custodian collection, with attestation | per custodian | $900 | Plus shipping. Records what they handed me. |
| Mobile extraction, logical or advanced logical | per device, per attempt | $850 $600 further device | Buys the attempt, not the result. |
| Mobile, full file system attempt | per device | $1,800, quoted after inspection | Logical level, logical price. A handset may be unreachable. |
| Cloud collection: mailbox and drive | per custodian | $1,100 $450 further custodian, same tenant | Nothing that was never logged. |
| Cloud tenant preservation: holds and log exportindicative | per tenant, per platform | $2,400 | Preserves forward, restores nothing. |
Copies, opinions and advisory
| Service | Unit | Price | Does not establish |
|---|---|---|---|
| Verified forensic copy for production | per copy | $350 | Plus media. |
| Second opinion on an internal IT finding | per finding | $2,600 | Where internal activity destroyed it, it says so. |
| Review of an opposing report, finding by finding, with questions to put | flat | $3,250 | Untestable is not wrong. |
| Declaration or affidavit restating completed work | per document | $1,800 | New testing is hourly. |
| Cloud logging review: retention and coverageindicative | per M365 or Google tenant | $4,200 $1,800 per AWS account | Auditing logs forward only. |
| Tabletop exercise, half-dayindicative | per exercise | $6,500 | How people decide, not that the plan works. |
| Evidence storage after close | per matter per month, ≤4 TB | $75 | $15/TB/month above 4 TB, first 90 days included. Not archival. |
| Certified destruction, certificate issued | per matter | $150 | Nothing about copies others hold. |
Testimony
| Line | Price |
|---|---|
| Deposition, remote | $550/hr, 4-hour minimum |
| Deposition, in person | $4,800 a day or part, plus travel |
| Trial, hearing or arbitration | $5,600 a day or part, plus travel |
| Preparation | Principal rate |
| Standby, reserved, not called | Applicable day rate |
| Prepayment, reconciled after, balance refunded | Estimated fee |
| Released more than 3 business days ahead | No charge |
| Released inside 3 days / inside 1 day | 50% / 100% |
Testimony is never capped — the schedule belongs to the court. Billed to the retaining party whatever the outcome. Where the opposing party notices the deposition, FRCP 26(b)(4)(E) ordinarily puts the fee on them. Where a matter needs a previously qualified testifying expert, the letter says so; I bring one in or decline.
Incident response
| Line | Unit | Price | Does not establish |
|---|---|---|---|
| Emergency mobilisation, time-boxed: preservation direction, triage of up to five systems, preliminary position, scoped proposal with a ceiling. Uplift included, credited in fullindicative | per incident | $6,000 | Not how the intrusion happened, or what must be notified. |
| Standby: conflicts pre-run against named adversaries, rate fixed for the year, MSA and out-of-hours authorisation pre-signed. Credited against the first engagement, or converts to a tabletop | per year | $7,500 | Card less 15%, uplift waived 48 hours. A conflict against an unnamed party still stops me. |
A response commitment exists only under a signed standby agreement; without one there is no service level. No overage, no surge rate: hours beyond a standby credit bill at the retained rate, not above it. Unretained callers, read the emergency page.
eDiscovery
| Line | Unit | Price | Note |
|---|---|---|---|
| Processing and ingestindicative | per GB as collected, pre-expansion, pre-deduplication | $22/GB | I do not bill expanded volume. |
| Review hosting, no analytics | per GB per month | $9 | I say when volume can come down. |
| Review hosting, with analytics | per GB per month | $14 | Privilege stays a lawyer's call. |
| Review platform user licence | per user per month, at cost | $75 | Pass-through, no commission. |
| Imaged productionindicative | per page | $0.05 | I flag a format that degrades usability. |
| TAR protocol design and validationindicative | per project | $6,500 | Measured performance, not completeness. |
Quoted, not published
Any examination or analysis is hourly against a written ceiling. Server, RAID, NAS or virtual host imaging is a ceiling quoted after a technical call. Mobile physical, before-first-unlock, chip-off and ISP are quoted after inspection or referred out. A Rule 26(a)(2)(B) report is an estimated band with a stop-and-confer point. Intrusion response is staged from the mobilisation block; breach notification lists are priced on record count.
Conditions
No discounts, promotions or volume tiers. Two things lower it: the standby retained rate and the bank-transfer discount on engagement.
No minimum hours on examination or collection.
Nothing starts before conflicts clear and the letter is signed; money paid earlier is held unapplied, refunded in full.
Where a matter requires a certified examiner, an accredited laboratory or a licence, the engagement letter states it and it is satisfied before work begins. I check your venue first.
I will not
- Take a fee that depends on what I find or which side retains me.
- Take or pay a referral fee, in either direction.
- Take a vendor commission, or sell you the remediation I investigated.
- Bill an hour above the ceiling you authorised.
- Image a whole disk where a targeted collection answers the question.
- Keep quiet about culling that cuts your bill from five figures to four.
- Carry an overage or surge rate.
- Deduct card fees from money I return to you.
Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem. The call is free, including the one where you don't need me.