Questions attorneys ask before they call.

Federal Rule of Evidence 902(14) lets electronic evidence be self-authenticated through a written certification from a qualified person — no live witness required at trial just to prove the data is what it claims to be. In practice, that means a signed forensic declaration from a qualified examiner can replace hours of foundational testimony, save your client money, and remove an avoidable point of attack from opposing counsel. A 902(14) declaration is available as an add-on on any collection (priced separately on the services page) so the evidence can be trial-ready the day you receive it.

Yes. If a collection is challenged, deposed, or goes to a Daubert hearing, I can testify to the methodology, tools, and chain of custody. Expert testimony, depositions, declarations beyond the standard 902(14), and trial appearances are billed hourly rather than at the flat collection rate — quoted in advance once the scope is known.

Yes — every engagement. Each device, account, and data set is logged from the moment it enters my custody through delivery, with timestamps, hash values, custodian acknowledgements, and handler signatures. The chain of custody and accompanying examiner logs are retained permanently and provided alongside the deliverables.

Mobile devices (calls, texts, iMessage, photos, notes, calendar, web history, and major third-party apps like WhatsApp, WeChat, KakaoTalk, Signal). Email — corporate (Microsoft 365 / Purview, Google Vault) and personal (Gmail, Yahoo, iCloud). Computers — Windows, macOS, and external storage (full disk or targeted). Cloud storage — Google Drive, OneDrive, iCloud Drive, Dropbox. Chat applications — WhatsApp, Signal, WeChat, Microsoft Teams, Facebook Messenger, Instagram DMs. AI chats — ChatGPT, Gemini, Claude. If your data source isn't listed, ask — most platforms with an export or API can be collected forensically.

Yes. A typical mobile collection takes a few hours and the device is returned to the custodian unchanged — no apps removed, no data altered, no settings reset. The custodian can resume normal use as soon as the collection finishes. Where possible we schedule around their day (overnight, lunch breaks, end of day) to minimize disruption.

Only if the passcode is known. Modern smartphones (recent iPhones and Android devices) use hardware-backed encryption that cannot be bypassed without the passcode — not by me, and not by any commercial forensic tool on the market. If the passcode is unknown the device cannot be collected. Cloud accounts (iCloud, Google) tied to that custodian are sometimes still recoverable through legal process, even when the device itself isn't.

Sometimes — it depends on the application, the device, and how long ago the data was deleted. Some apps retain deleted content in local databases for a window of time and those fragments can be recovered. On modern smartphones, however, most truly deleted messages are unrecoverable because of how the operating system manages encrypted storage. I'll always tell you upfront what's realistic for the specific device and app before you commit.

Both are options. Remote phone collections — I ship a collection kit to the custodian and we walk through the process together on a scheduled video call. Remote computer collections — same idea with a pre-configured collection drive. Email, cloud storage, and chat account collections are fully remote with no hardware shipped at all. On-site collections require the least effort from the custodian and are ideal for executives, multiple custodians at one location, or sensitive matters. I'm based in the greater Salt Lake City area and travel nationwide; outside of greater Salt Lake, travel is billed at cost.

The forensic collection itself is preserved in its native collection format — a complete, hash-verified image of the device or account. Reports and review-ready exports are tailored to the matter and the downstream tool: searchable PDF, HTML, Excel timelines, RSMF for chat threads, or load files (DAT/OPT) for Relativity, Everlaw, Reveal, and other review platforms. Tell me where the data is going and I'll produce it in the right shape.

No. The flat fee on the services page is what you pay. The only addition is travel expenses for on-site collections outside of the greater Salt Lake area (mileage, airfare, lodging) — billed at cost with receipts and quoted upfront before any travel is booked. No surprise invoices, no hourly creep.

Yes — 50% of the engagement total is due before collection begins, with the remaining 50% due upon delivery of the data and reports. This applies to flat-fee work; expert testimony and other hourly work are billed separately on standard terms.

Either works. Many firms prefer to invoice the client and pay me from a trust or operating account; others have the client pay me directly. I'm flexible — just let me know during scoping who the bill-to party is.

Collected data is captured directly to encrypted hard drives and remains encrypted at rest throughout the engagement. Decryption keys are stored separately in a secure key manager and shared with counsel through encrypted channels — never alongside the data itself. Transfer is done over end-to-end encrypted file transfer or by shipping encrypted physical media; you choose.

I do not offer long-term data preservation as a service. Collected data and any reports/exports are kept for 30 days after delivery as a courtesy in case you need a re-export, then securely destroyed. The chain of custody, examiner logs, and signed declarations are retained permanently so the work can always be authenticated later.

Yes — every Statement of Work doubles as an NDA and is signed before any engagement begins. If your firm has a standard NDA you'd prefer to use instead, send it over and I'll sign that as well.

EnCE — EnCase Certified Examiner, issued by OpenText/Guidance Software, the long-standing industry standard certification for forensic examiners using EnCase, the tool most often cited in U.S. case law. MCFE — Magnet Certified Forensics Examiner, issued by Magnet Forensics for proficiency with AXIOM, the leading platform for mobile and cloud forensics. CCME — Cellebrite Certified Mobile Examiner, the senior-level certification for forensic mobile collections using Cellebrite (the tool used by most U.S. law enforcement agencies for phone evidence). Together these cover the three platforms that handle the overwhelming majority of forensic work admitted in U.S. courts.