Print this page (attorney exhibit format)
These records are commonly used to support internal review, insurance claims handling, and legal preservation obligations.
Our Process
Forensic imaging and evidence preservation activities are conducted using generally accepted, documented, repeatable acquisition procedures with integrity verification from documented, repeatable acquisition procedures with integrity verification and documented, repeatable acquisition procedures with integrity verification. (See Preservation Principles.)
This page presents a high-level overview of how evidence-related work typically proceeds—from initial contact through documented handling—without reference to specific tools, guarantees, or outcomes.
All engagement scope, fees, and authorization are established in writing before any work begins. Verbal or telephone communications are used solely for clarification and do not modify written terms.
What you receive
- Chain-of-Custody Record (PDF)
- Acquisition Log and Handling Notes
- Hash Verification Record (where applicable)
- Storage / Device Metadata Sheet (where applicable)
- Delivery Manifest and Verification Outputs Documentation reflects technical evidence handling and preservation activities only.
Design Goals
- Clarity: define objectives and constraints before any technical work begins.
- Integrity: protect original materials and avoid unnecessary alteration.
- Repeatability: record steps so findings can be reviewed and explained.
- Conservatism: state assumptions and limitations plainly.
1. Intake & Screening
At-a-glance workflow
Work begins with written intake. The purpose of intake is to understand the question the evidence is intended to address, applicable deadlines, and any constraints affecting handling.
- Identify media types and general condition at a high level
- Flag potential risks (e.g., encryption, fragility, prior handling)
- Determine whether the request falls within the defined service scope
No preservation, collection, or analysis is performed prior to written scope acceptance.
2. Scope of Services
Before proceeding, scope is defined in writing so expectations are aligned.
- Objectives and deliverables
- Handling and transfer method
- Fees and timing
No work begins until scope and terms are reviewed and accepted in writing.
3. Forensic-grade evidence handling
When materials are received, they are documented and handled in a manner appropriate to the engagement.
- Identification and labeling
- Separation of originals and working copies where feasible
- Verification steps appropriate to the task Evidence handoff details ↓
4. Analysis
For cloud-hosted sources, data capture is performed using provider export or administrative tools (or approved APIs) under written authorization. Collected materials are logged and verified where feasible. Analysis is limited to the agreed scope and objectives.
Analysis is performed against the defined objectives, focusing on relevance and reliability rather than exhaustive exploration.
- Review of data artifacts relevant to the question
- Consistency and timeline checks
- Documentation of observations
Scope boundary: We focus on early-stage digital evidence preservation and acquisition.
When matters move beyond preservation into substantive analysis or expert interpretation, we may refer counsel to independent forensic firms based on scope and timing.
Conversely, when preservation or defensible acquisition is needed early in a matter, we are available to support downstream teams.
5. Reporting
Findings are summarized in clear, non-conclusory language, with methods and limitations described.
- What was examined
- What was observed
- What could not be determined, and why Evidence handoff details ↓
6. Findings Review & Verification Review
Questions and clarifications are addressed within the agreed scope. Any expansion of work is discussed and approved in writing.
- Clarifying questions from counsel or stakeholders
- Supplemental notes if needed
- Orderly close-out per agreed terms
Priority Preservation Pathway
Secure Priority Access to Evidence Preservation is available for urgent or high‑stakes matters where rapid, controlled handling is critical.
- Expedited intake and engagement
- Accelerated documentation and chain‑of‑custody initiation
- Priority scheduling of preservation activities
- Secure handling workflows for time‑sensitive evidence
Priority access is confirmed in writing as part of scope and scheduling. Standard preservation pathways remain available for non‑urgent matters.
Evidence Handoff
Devices or storage media are transferred by appointment.
In-person handoff within the greater Boston area is available by scheduled meeting.
Shipped submissions are accepted when appropriate.
All transfers are documented in chain-of-custody records to preserve evidence integrity.
Important Notes
- This page is descriptive, not contractual.
- No representations or guarantees regarding outcomes or admissibility are made.
- Legal advice is not provided.
For boundaries and exclusions, see Scope & Limitations.
Why Email-First Intake Matters
In evidence-related matters, the manner in which an engagement begins can be as significant as the work that follows.
An email-first intake approach creates a contemporaneous written record of what was requested, when the request was made, and how the matter was initially described. This initial context may become relevant later, particularly if questions arise regarding scope, timing, or decision-making at the outset of an engagement.
Verbal conversations can be useful for clarification, but they are inherently transient. Details may be misunderstood, incomplete, or recalled differently over time. Written intake helps reduce ambiguity by documenting the requester’s description of the matter in their own words at the time the request is made.
Email-based intake also supports consistency. Information can be reviewed, confirmed, and referenced without reliance on memory or informal notes. This can be especially relevant in matters involving multiple stakeholders, evolving issues, or extended timelines.
From a professional perspective, email-first intake is not a procedural formality. It provides a documented starting point before any evidence-related work is performed and before scope or handling decisions are confirmed.
In some matters, courts or opposing parties may later examine what information was available at the beginning of an engagement and how subsequent actions were informed by that information. A contemporaneous written record can assist in demonstrating how the initial request and scope considerations were understood at that time.
For these reasons, many evidence professionals use email-first intake as part of a structured workflow. It supports clarity, accountability, and transparency without relying on post-hoc reconstruction.
This discussion is provided for informational purposes only. It does not describe investigative methods, provide legal advice, or establish a professional engagement.