Standing Engagement Agreement · $0 to Establish · Net 30
Forensic collection retainer
Sign the engagement agreement, provide billing information, and agree Net 30 terms, at no cost. When a matter arrives, the rates are already set and the contracting is already done.
Contracting is the slowest part of an urgent collection.
The call usually comes with a deadline already attached. A hold has issued, a custodian is leaving Friday, or a production is due. Then everything stops while conflicts are cleared, an engagement letter is drafted, rates are negotiated, and someone in accounting sets up a vendor record. Days go by before anyone touches a device, and devices do not wait.
The retainer moves all of that to a quiet week. It costs nothing to put in place, obligates you to nothing, and leaves one step for the day it matters: authorize the work.
Scope
What the retainer covers
Endpoint collection
Windows and macOS workstations, laptops, and servers. Targeted logical collection or full forensic imaging, custodian-level, with hash verification at acquisition and delivery. Remote collection where authorized.
Mobile device acquisition
iOS and Android. Logical, file system, and full acquisitions as the device and operating system permit, with output formatted for attorney review or for a processing platform.
Drive and media imaging
HDD, SSD, and NVMe drives, USB devices, external drives, and removable media. Write-blocked acquisition producing E01, L01, or raw output with a full acquisition log.
Microsoft 365 and cloud
Mailbox, OneDrive, SharePoint, and Teams preservation through Purview eDiscovery, legal hold placement and documentation, and export packaging for review platforms.
Pricing
Collection and analysis are priced separately
Most quotes bundle acquisition and investigation into one number, which means you commit to the analysis before anyone knows whether the matter needs it. Here the two are separate, and the second one is optional.
| Service | Rate | Basis |
|---|---|---|
| Mobile device acquisition and processing | $2,500 | Flat, per single device |
| Hard drive imaging | $1,500 | Flat, per single drive |
| Endpoint, cloud, and eDiscovery workflow | $150/hr | Hourly |
| Investigation and analysis | $150/hr | Only if the matter calls for it |
| Storage media | At cost | No markup |
| Travel and on-site work | At cost | Advance written authorization |
What the flat rate buys
Forensic acquisition, hash verification, chain of custody documentation, and output formatted for review. From there you can search the output yourself, or engage 4n6PI to perform the investigation at the hourly rate. Where a matter needs one, a review platform is provided.
Multi-device matters are quoted per engagement. An optional rush surcharge of $500 applies where a matter requires work outside normal scheduling.
Process
How the retainer works
Submit the inquiry
A brief conversation to document your organization, the matter types you typically see, and any collection preferences.
Engagement agreement executed
4n6PI provides an agreement documenting rates, scope, Net 30 terms, and confidentiality. Your organization provides billing information and signs. No payment at this stage. The agreement is $0 to establish.
The retainer is active
The relationship exists. No deposit, no monthly minimum, no further setup, and no obligation until you authorize work on a matter.
A matter arrives
Call or email directly. Scope is confirmed, work is authorized in writing, and collection is scheduled. Most collection matters are scheduled within two business days of authorization. Each matter is invoiced separately on completion at the rates already on file, due Net 30.
Get started
Establish your retainer
4n6PI follows up within one business day to finalize the engagement agreement. No cost and no commitment until work is authorized on a matter.