Scope of services
Every service I perform, what it costs or how it is priced, and whether I take it, refer it out or decline it. Every line also carries what that service does not establish.
- Document
- WW-F-003
- Version
- 1.0
- Issued
- 2026-09-11
- Last revised
- 2026-09-11
- Scope
- Services, price class, limits
- Authority
- Principal
How the prices work
FIXED buys a stated artefact. HOURLY · CEILING is the published rate against a written stop-point: nothing above it is billed, and at 80% I stop and report. TRIAGE is a fixed first block, credited against what follows. FIXED UNIT publishes the unit, not the total.
Everything below I TAKE; refer-outs and declines last.
Host and disk forensics
You hold the image, its hashes and a signed chain of custody.
| Service | Price | Not established |
|---|---|---|
| Acquisition — computer, drive, media | $950 / $1,450 / Quotedto 2 TB, 2–8 TB, 8 TB+; media at cost above 2 TB; 90 days storage; $650 each further device, same matter, site and day | Who created or deleted it. |
| Targeted artefact collection | $475manifest of what was left | Anything outside the collected set. |
| On-site collection | $2,900per examiner-day; to 8 hours within 60 miles, travel beyond at cost | That every device was disclosed. |
| Remote or custodian-kit collection | $900plus shipping | That the custodian collected everything. |
| Server, RAID, NAS, hypervisor imaging | QuotedHOURLY · CEILING | Deleted content, on a live export. |
| Verified copy for production | $350plus media | Admissibility. FRE 902(14) needs a 902(11) certificate. |
| Evidence storage after closing | $75per matter per month, to 4 TB; 90 days after final invoice free | Any retention duty of yours. |
| Certified destructionon written instruction | $150 | That no other copy exists. |
| Filesystem, artefact, timeline examination | Hourly, capped | Who was at the keyboard. |
| Deleted-data recovery and carving | Hourly, capped | That anything is recoverable. |
| Data-theft and exfiltration examination | Hourly, capped | Intent. Copying looks like sync. |
| Deletion and wiping examination | Hourly, capped | Intent to deprive: FRCP 37(e)(2). |
| Password and encrypted-volume attack | Hourly, cappedwritten cap agreed first | Success. No key, no volume. |
| Second opinion on an IT finding | $2,600per finding | The state before IT arrived. |
Mobile devices
Priced per attempt, not per result.
| Service | Price | Not established |
|---|---|---|
| Extraction — logical or advanced logical | $850per device, per attempt; $600 each further device, same matter | A complete handset; logical gets what is offered. |
| Extraction — full file system attempt | $1,800logical price if only logical | That the deeper level is reachable. |
| Examination — messaging, call, location, apps | Hourly, capped | Who held the phone. |
| Physical, before-first-unlock, advanced unlock | Not publishedquoted after inspection; TAKE or REFER OUT | That it can be done. |
Cloud and SaaS
Nothing write-blocks a cloud account; the record is the method: tool, version, hash, authority, retention.
| Service | Price | Not established |
|---|---|---|
| Cloud account collectionone mailbox, one drive | $1,100per custodian; $450 each further, same tenant and export | Anything outside the retention window. |
| Tenant preservationholds applied, log exported | $2,400per tenant, per platform | That a hold caught what preceded. |
| Audit log and sign-in examination | Hourly, capped | That an action did not occur; MailItemsAccessed is often off. |
| Logging and evidence-readiness review | $4,200per M365/Google tenant; $1,800 per AWS account | That a future incident is answerable; auditing logs forward. |
| SaaS with no export or audit facility | Triage first | That a defensible collection exists. |
Memory, network and malicious code
| Service | Price | Not established |
|---|---|---|
| Volatile memory capture and examinationup to five systems inside emergency mobilisation | Hourly, capped | The machine before capture. |
| Network, proxy and EDR telemetry; malware triage | Hourly, capped | The person behind an address; behaviour is not authorship. |
Incident response
What to do in the first hour is free to read.
| Service | Price | Not established |
|---|---|---|
| Emergency mobilisationpreservation, triage of up to five systems, a written position and priced plan; credited | $6,000per incident | A conclusion. It buys a position and a plan. |
| Intrusion and ransomware examination | Hourly, capped | That nothing was exfiltrated. |
| Business email compromise | Triage first | The money back: banks and ic3.gov. |
| Breach data mining, notification list | Quotedon record count | Whether notification is required. |
| Tabletop exercise and plan reviewhalf-day, marked-up plan | $6,500per exercise | Readiness. It tests decisions, not systems. |
| Standby agreementconflicts pre-run, rates fixed, out-of-hours authorisation pre-signed; credited | $7,500per year | Unlimited availability. No surge rate either. |
eDiscovery and litigation support
Per-unit prices and their review date are on the eDiscovery page.
| Service | Price | Not established |
|---|---|---|
| Identification, preservation, legal hold | Hourly, capped | When your duty attached. |
| Processing and ingest | $22/GBon source volume as collected, pre-deduplication; FIXED UNIT | A total; quantity is unknown beforehand. |
| Review hosting | $9–$14per GB/month; $9 plain, $14 with analytics | The duration; often the largest line. |
| Review platform user licences | $75per user/month, passed through | Any margin to me. |
| Production | $0.05per imaged page | That a specified format serves you. |
| TAR protocol design and validation | $6,500per project | Recall you have not measured. |
| Privilege filter protocolflagging only; FRCP 26(b)(5)(A) log | Hourly, capped | The privilege call; the court decides. |
| Project management; Rule 26(f) conference | $180/hr | Agreement; counsel negotiates that. |
Against my own interest: culling early moves a bill from five figures to four, and the larger bill is mine. Ask what hosting costs first.
Expert support and testimony
Testimony is billed whatever the outcome, never capped: the court sets the schedule.
| Service | Price | Not established |
|---|---|---|
| Review of an opposing examiner's reportfindings marked supported, partly, unsupported, untestable | $3,250flat | That an unsupported finding is wrong. |
| Consulting expert, non-testifying | Hourly, capped | Protection; 26(b)(4)(D) has exceptions. |
| Declaration restating completed work | $1,800per document | New findings; fresh testing is hourly. |
| Rule 26(a)(2)(B) expert report | Quotedband, after examination | A price at engagement; cost tracks exhibits. |
| Deposition, remote | $550/hr4-hour minimum | A capped total; they set length. |
| Deposition in person; trial, hearing, arbitration | $4,800 / $5,600per day or part, plus travel | That a reserved day resells. |
| Appointed neutral or joint examiner | Hourly, capped | Neutrality after the fact. |
What I refer out, and what I decline
REFER OUT: I name someone, no fee either way. DECLINE: not at any price.
| Work | Position | Why |
|---|---|---|
| Chip-off, ISP, JTAG; implant reverse engineering | REFER OUT | Board-level work; I read the output. |
| Enterprise or multi-jurisdiction response | REFER OUT | Panel-consultancy tier; I work alongside. |
| Managed review; information governance | REFER OUT | Puts me both sides of culling. |
| Matters needing a certification or licence I lack | REFER OUT / DECLINE | Named in the engagement letter, or declined. |
| Handset repair or unlocking for convenience | DECLINE | Not forensic work. |
| Monitoring, managed detection, SOC | DECLINE | I cannot staff it. |
| Collection without the holder's authority | DECLINE | 18 U.S.C. § 2702. |
| Ransom negotiation, payment, actor contact | DECLINE | Sanctions and your carrier: counsel's. |
| Remediation on systems I examined | DECLINE | I will not sell what I investigated. |
| Acting for both sides | DECLINE | A mid-matter conflict stops work. |
What is never charged
No minimum-hours charge; the only minimums are for testimony.
Free: the scoping and preservation call, up to 45 minutes; the call where data cannot answer you; the call where you do not need me.
Where a matter requires a certified examiner, an accredited laboratory or a licence, that is stated in the engagement letter, or I decline. Method follows ISO/IEC 27037:2012 and NIST SP 800-86: guidance, not accreditation. Not an ISO/IEC 17025 laboratory; nothing here promises a finding.
One of those free calls is probably yours. Ring me on 917-217-7975 and I will tell you whether this is even a forensics problem.