Question 1

What is FRE 902(14) and why does it matter?

Accepted Answer

Federal Rule of Evidence 902(14) lets electronic evidence be self-authenticated through a written certification from a qualified person — no live witness required at trial just to prove the data is what it claims to be. In practice, that means a signed forensic declaration from a qualified examiner can replace hours of foundational testimony, save your client money, and remove an avoidable point of attack from opposing counsel. A 902(14) declaration is available as an add-on on any collection (priced separately on the services page) so the evidence can be trial-ready the day you receive it.

Question 2

Can you serve as an expert witness if my collection is later contested?

Accepted Answer

Yes. If a collection is challenged, deposed, or goes to a Daubert hearing, I can testify to the methodology, tools, and chain of custody. Expert testimony, depositions, declarations beyond the standard 902(14), and trial appearances are billed hourly rather than at the flat collection rate — quoted in advance once the scope is known.

Question 3

Do you maintain a documented chain of custody?

Accepted Answer

Yes — every engagement. Each device, account, and data set is logged from the moment it enters my custody through delivery, with timestamps, hash values, custodian acknowledgements, and handler signatures. The chain of custody and accompanying examiner logs are retained permanently and provided alongside the deliverables.

Question 4

What types of data can you collect?

Accepted Answer

Mobile devices (calls, texts, iMessage, photos, notes, calendar, web history, and major third-party apps like WhatsApp, WeChat, KakaoTalk, Signal). Email — corporate (Microsoft 365 / Purview, Google Vault) and personal (Gmail, Yahoo, iCloud). Computers — Windows, macOS, and external storage (full disk or targeted). Cloud storage — Google Drive, OneDrive, iCloud Drive, Dropbox. Chat applications — WhatsApp, Signal, WeChat, Microsoft Teams, Facebook Messenger, Instagram DMs. AI chats — ChatGPT, Gemini, Claude. If your data source isn't listed, ask — most platforms with an export or API can be collected forensically.

Question 5

Can you collect from a phone the custodian still needs to use day-to-day?

Accepted Answer

Yes. A typical mobile collection takes a few hours and the device is returned to the custodian unchanged — no apps removed, no data altered, no settings reset. The custodian can resume normal use as soon as the collection finishes. Where possible we schedule around their day (overnight, lunch breaks, end of day) to minimize disruption.

Question 6

Can you collect from a deceased person's device or a locked phone?

Accepted Answer

Only if the passcode is known. Modern smartphones (recent iPhones and Android devices) use hardware-backed encryption that cannot be bypassed without the passcode — not by me, and not by any commercial forensic tool on the market. If the passcode is unknown the device cannot be collected. Cloud accounts (iCloud, Google) tied to that custodian are sometimes still recoverable through legal process, even when the device itself isn't.

Question 7

What about deleted messages — can you recover them?

Accepted Answer

Sometimes — it depends on the application, the device, and how long ago the data was deleted. Some apps retain deleted content in local databases for a window of time and those fragments can be recovered. On modern smartphones, however, most truly deleted messages are unrecoverable because of how the operating system manages encrypted storage. I'll always tell you upfront what's realistic for the specific device and app before you commit.

Question 8

Are collections done remote or on-site? How do you decide?

Accepted Answer

Both are options. Remote phone collections — I ship a collection kit to the custodian and we walk through the process together on a scheduled video call. Remote computer collections — same idea with a pre-configured collection drive. Email, cloud storage, and chat account collections are fully remote with no hardware shipped at all. On-site collections require the least effort from the custodian and are ideal for executives, multiple custodians at one location, or sensitive matters. I'm based in the greater Salt Lake City area and travel nationwide; outside of greater Salt Lake, travel is billed at cost.

Question 9

How is the evidence delivered, and in what format?

Accepted Answer

The forensic collection itself is preserved in its native collection format — a complete, hash-verified image of the device or account. Reports and review-ready exports are tailored to the matter and the downstream tool: searchable PDF, HTML, Excel timelines, RSMF for chat threads, or load files (DAT/OPT) for Relativity, Everlaw, Reveal, and other review platforms. Tell me where the data is going and I'll produce it in the right shape.

Question 10

Are there ever extra costs beyond the fixed price?

Accepted Answer

No. The flat fee on the services page is what you pay. The only addition is travel expenses for on-site collections outside of the greater Salt Lake area (mileage, airfare, lodging) — billed at cost with receipts and quoted upfront before any travel is booked. No surprise invoices, no hourly creep.

Question 11

Do you require a retainer?

Accepted Answer

Yes — 50% of the engagement total is due before collection begins, with the remaining 50% due upon delivery of the data and reports. This applies to flat-fee work; expert testimony and other hourly work are billed separately on standard terms.

Question 12

Can my client pay directly, or does it have to go through the firm?

Accepted Answer

Either works. Many firms prefer to invoice the client and pay me from a trust or operating account; others have the client pay me directly. I'm flexible — just let me know during scoping who the bill-to party is.

Question 13

How is collected data stored and transmitted?

Accepted Answer

Collected data is captured directly to encrypted hard drives and remains encrypted at rest throughout the engagement. Decryption keys are stored separately in a secure key manager and shared with counsel through encrypted channels — never alongside the data itself. Transfer is done over end-to-end encrypted file transfer or by shipping encrypted physical media; you choose.

Question 14

How long do you retain the evidence after delivery?

Accepted Answer

I do not offer long-term data preservation as a service. Collected data and any reports/exports are kept for 30 days after delivery as a courtesy in case you need a re-export, then securely destroyed. The chain of custody, examiner logs, and signed declarations are retained permanently so the work can always be authenticated later.

Question 15

Do you sign NDAs?

Accepted Answer

Yes — every Statement of Work doubles as an NDA and is signed before any engagement begins. If your firm has a standard NDA you'd prefer to use instead, send it over and I'll sign that as well.

Question 16

What do EnCE, MCFE, and CCME actually mean?

Accepted Answer

EnCE — EnCase Certified Examiner, issued by OpenText/Guidance Software, the long-standing industry standard certification for forensic examiners using EnCase, the tool most often cited in U.S. case law. MCFE — Magnet Certified Forensics Examiner, issued by Magnet Forensics for proficiency with AXIOM, the leading platform for mobile and cloud forensics. CCME — Cellebrite Certified Mobile Examiner, the senior-level certification for forensic mobile collections using Cellebrite (the tool used by most U.S. law enforcement agencies for phone evidence). Together these cover the three platforms that handle the overwhelming majority of forensic work admitted in U.S. courts.

Questions attorneys ask before they call.

Court Admissibility & Legal

Scope & Capabilities

Logistics

Pricing & Billing

Security & Confidentiality

Credentials

Still have a question?