Forensic Service

Computer forensic collection.

Full or targeted forensic imaging of Windows and Mac workstations — preserving documents, deleted files, browser history, and user activity artifacts with court-tested methodology.

Flat Fee

$875

No retainer required upfront

Collection Method

Remote or On-site

Ship drive or in-person visit

Turnaround

1–3 Days

After collection is complete

What gets preserved.

All documents and files (current and deleted)
Browser history, downloads, and bookmarks
Email client data (Outlook, Apple Mail)
USB and external device connection history
System event logs and user activity artifacts
Recycle bin and recently deleted files
File access and modification timestamps
Chain-of-custody report & hash verification

Who it's for

Common matters we support.

When the evidence lives on a laptop or workstation.

Trade Secret & IP Theft

Documenting file access, copying to external drives, or email exfiltration before a departing employee's device is wiped.

Employee Misconduct

Browser history, communications, and user activity on company-issued hardware when HR or legal has concerns.

Fraud Investigations

Document creation timelines, file modification metadata, and deleted records that reveal intent or concealment.

Wrongful Termination

Preserving the state of an employee's computer at the time of termination to establish a factual record.

Contract Disputes

Document authenticity questions — when did a file actually exist, who created it, and was it altered after the fact?

Divorce & Family Law

Financial records, hidden accounts, or communications on a shared or personal computer when consent exists.

Questions

About computer collections.

What's the difference between a full image and a targeted collection?

A full forensic image captures a bit-for-bit copy of the entire drive, including deleted files, unallocated space, and all system artifacts. A targeted collection focuses on specific folders, file types, or a date range. Full images are preferred when you're not sure what you're looking for; targeted collections work well when scope is clear and drive size is large. We'll recommend the right approach during scoping.

Can this be done remotely without shipping the computer?

Yes, for many cases. We can perform a targeted remote collection using forensic tools over a secure connection, walking the custodian through the process on a video call. For full disk images or situations where chain-of-custody demands physical control of the device, shipping a write-protected drive or an on-site visit is recommended.

What if the hard drive has been reformatted or the computer wiped?

Some data may still be recoverable after a reformat, depending on the type and how long ago it occurred. More importantly, the act of wiping a device after litigation is reasonably foreseeable can itself constitute spoliation — we document exactly what we find (and what we don't), which may be independently valuable.

Does forensic collection affect the computer's normal operation?

No. Forensic collection is a read-only process — we never write to or alter the source drive. For physical collections, the drive is connected through a hardware write blocker. The computer's normal operation is not affected, and the original data is never modified.

See all FAQs

Ready to preserve this computer?

Book a free 15-minute scoping call. We'll confirm the right approach and give you a fixed price on the spot.

Schedule Free Consult View All Services