Incident in progress What to do in the first hour → Preserve first. Several ordinary responses destroy the evidence permanently.
Wirewalk Forensics and Security

Instruction roles

Four ways to instruct a forensic examiner, and they carry different discovery obligations. Your lawyer picks the role — but it has to be picked before the first artefact is touched.

Document
WW-F-008
Version
1.1
Issued
2026-09-11
Last revised
2026-09-11
Scope
Instruction roles and discovery posture
Authority
Principal

Four ways to instruct me

Pick the role before I touch anything. Day-one notes travel with the file, governed by the role in force then.

The role changes your discovery exposure, not my rate. Principal time is $425/hr against a written ceiling you authorise. Testimony bills on the published schedule, never capped. Scoping call, no charge.

Who instructs, what is discoverable, what you hold
RoleWho instructsOrdinarily discoverableWhat you end up holdingWhat this does not establish
Testifying expert Counsel, or the party Report and bases; everything considered; exhibits; my fee; me, at deposition A signed report meeting FRCP 26(a)(2)(B), and my time in the chair That anything outside the report is protected.
Consulting expert
non-testifying
Counsel Very little, absent exceptional circumstances A written position to counsel: what the artefacts show, what they do not reach That the work is invisible. The evidence stays discoverable.
Appointed neutral Both parties jointly, or the court Everything — protocol, notes, findings, examiner The protocol and the findings, to every party and the court That an appointment makes a finding harder to contest.
Rebuttal or second opinion Counsel, either footing above Whichever row above applies Each finding marked supported, partly supported, unsupported or untestable, and the questions to put That untestable means wrong — usually the method was unreproducible.
Technical adviser
no examination, no opinion
Counsel only Ordinarily nothing, while it stays advisory A memorandum, deposition questions, or a mark-up of an ESI protocol That advice is privileged because I gave it. Structure decides that, not me.

Neutral appointments run under FRE 706, or FRCP 53 for a supervised protocol; the appointing order governs, not my letter.

Before you choose

Protection is qualified, never absolute. FRCP 26(b)(4)(B) covers draft reports, 26(b)(4)(C) attorney–expert communications — trial-preparation material, overcome-able and easily waived. Three carve-outs always get through: my fee, facts counsel supplied that I considered, assumptions I relied on. So counsel's material is logged apart from the artefacts and my notes.

The consulting shield ends if the role does. It covers my facts and opinions, not the evidence. Where an examination consumes what it examines — volatile memory, a one-attempt extraction — the exceptional-circumstances exception has teeth. I say so first.

State practice differs. New York runs under CPLR 3101(d), not a federal-form report, and remains a Frye jurisdiction. I check your venue and state it in the letter.

Privilege

Involving me does not make anything privileged. Forensic reports are not automatically work product; courts have ordered them produced, usually where one report served both litigation and remediation. Separate workstreams and a tight distribution list support the claim. I cannot promise it holds.

If the role changes

I put in writing what it does to the file: what becomes disclosable, what protection does not survive, what cannot be undone.

A conflict stops the work that day: evidence sequestered unexamined, unearned balance refunded in full.

I will not

  1. Take a fee that turns on what I find, the outcome, or which side retains me.
  2. Act for both sides, or act as neutral where I have advised either side.
  3. Opine on who was at the keyboard from device evidence alone, or on intent to destroy.
  4. Take a matter needing a qualification I do not hold. Where a matter requires a certified examiner, that is named in the engagement letter, or the matter is declined.

Full list on the home page and in the engagement letter.

Not sure which role you need? Ring me on 917-217-7975 and I will tell you what each one costs you in discovery before your lawyer decides.