Endpoints · Mobile Devices · Removable Media · Cloud Accounts
Forensic collection and preservation
Getting the evidence off the device correctly is the part that cannot be redone later. Everything downstream depends on it, and nothing downstream can repair it.
A preservation obligation starts before anyone is retained.
The duty to preserve attaches when litigation is reasonably anticipated, which is almost always earlier than the day a forensic examiner is called. In the gap between those two dates, ordinary operations keep running. Devices sync. Retention policies fire. A departing employee's laptop goes back into the refresh pool. None of that is anyone acting in bad faith, and all of it destroys evidence just as effectively.
Collection is the step that stops the clock. Once a defensible image exists, the original can go back into service and the record is fixed as of a known moment, with documentation showing it has not changed since.
Scope
What gets collected
Computers and servers
Windows and macOS workstations, laptops, and servers. Full forensic imaging or targeted logical collection, chosen to match what the matter actually requires rather than defaulting to the largest possible capture.
Mobile devices
iOS and Android. Logical, file system, and full acquisitions where the device, operating system version, and lawful access permit, with the method selected to maximize recoverable data without altering the source.
Drives and removable media
HDD, SSD, and NVMe drives, USB devices, external drives, and legacy media. Write-blocked acquisition producing E01, L01, or raw output with a full acquisition log.
Microsoft 365 and cloud accounts
Mailbox, OneDrive, SharePoint, and Teams content through Purview eDiscovery, plus cloud account collection where a matter extends past the device itself.
Method
What makes a collection defensible
- Write-blocked acquisition. Nothing on the original changes during collection. The source device is returned in the state it arrived.
- Hash verification at both ends. The image is hashed at acquisition and again at delivery, so the copy can be proven identical to the source at any later point.
- Custody signed at handoff. Chain of custody is executed at the moment the device changes hands, not routed for signature afterward, so the signature and the custody event share one clock.
- One device, one record. Each device is documented as its own evidentiary universe. Findings from one are never carried across to another.
- Method documented, not just result. The acquisition log records what was done, with what tool, in what version, so another examiner could repeat it.
Engage
When to call
- A litigation hold has issued and devices need to be preserved before they are wiped or reassigned
- An employee is leaving and the company needs the device preserved before it is refreshed
- Opposing counsel has demanded production from a specific custodian's device
- A matter is anticipated but not yet filed, and preservation cannot wait for the complaint
- A client or custodian is holding a phone and needs to know what to do with it right now
Before you touch the device
Do not power it on to look around, do not connect it to a computer, and do not let anyone log in. Leave it powered as you found it, and call. The five minutes spent checking whether something is on a device is frequently the five minutes that changes what can be proven about it later. That call costs nothing.
Pricing
Collection is priced apart from analysis
A flat per-device rate covers acquisition, hash verification, chain of custody documentation, and output formatted for review. What happens next is your decision, not a bundled assumption.
| Service | Rate | Basis |
|---|---|---|
| Mobile device acquisition and processing | $2,500 | Flat, per single device |
| Hard drive imaging | $1,500 | Flat, per single drive |
| Endpoint and cloud collection | $150/hr | Hourly |
| Investigation and analysis | $150/hr | Only if the matter calls for it |
| Storage media | At cost | No markup |
You can take the collected output and search it yourself, or engage 4n6PI to perform the investigation. Where a matter needs one, a review platform is provided. Multi-device matters are quoted per engagement.
A standing retainer puts rates and billing terms in place before a matter arrives, at no cost to establish.
Preserve it now, decide later
Collection is reversible in the sense that a preserved image can sit untouched indefinitely. The failure to collect is not reversible at all.