Digital Forensics
A defined order. A disciplined collection.
We work with counsel to plan and carry out digital evidence collection within a court order’s scope and the agreed instructions. We help translate those requirements into a practical, documented collection.
01
Turn the order into a practical collection plan.
Counsel may need digital sources preserved quickly while keeping the collection within defined authority. We review the order and instructions with the responsible legal team, identify permitted devices, accounts and locations, and translate those requirements into technical collection steps. Interpretation of the order and questions about legal authority remain with counsel and the responsible officers.
02
Prepare for access, interruption and unexpected conditions.
Planning includes the systems likely to be encountered, available administrators, encryption, cloud services, business operations and attendance arrangements. We discuss whether sources can be preserved on site, require laboratory work or need separately authorized account access. An unexpected device or personal account is not automatically treated as within scope.
03
Keep collection separate from decisions about review.
The order or agreed protocol may distinguish preservation from later examination, disclosure or production. We follow the instructed boundaries and document which material has been collected, which remains restricted and who is authorized to receive it. Questions about disputed scope or protected material are referred through the agreed legal process rather than resolved by an unrestricted technical search.
04
Document the work and any exceptions.
We record sources, collection methods, handling and verification appropriate to the acquisition. If access is unavailable, a system has changed or the planned method is impractical, we document the condition and seek direction where needed. The resulting inventory and collection record help counsel understand what was preserved and what was not.
05
Agree the logistics before attendance.
Provide the order, proposed protocol, timing, locations and relevant technical contacts through an agreed channel. Explain any restrictions on business interruption, copying, access or delivery. Availability, personnel and scope must be confirmed for the matter; contacting DFI does not itself reserve an attendance or establish an engagement.
RELEVANT SOURCES
Start with what is available.
We help you identify which available sources can answer your question, within an authorized scope.
Devices and sources within the orderBEFORE WE BEGIN
Here is what helps us understand your matter.
- Provide the order and any collection or review protocol.
- Confirm counsel, supervising roles, attendance, locations and timing.
- Identify expected systems, administrators, encryption and operational constraints.
- Agree handling of unexpected sources, restricted material and delivery.
YOUR NEXT STEP
What do you need to understand?
Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.