Reports · Extractions · Exhibits · Methodology
Independent forensic review
You have a forensic report from the other side. It is formatted well, it has screenshots, and it reaches a conclusion your client says is simply not what happened.
A forensic report is an argument about data. It is not the data.
Between the source device and the sentence in the report there are a dozen decisions: which acquisition method was used, what was collected and what was skipped, which tool parsed the output, how that tool labeled a field, which records were filtered out before anyone looked, and what the examiner concluded from what was left. Each of those decisions is reviewable. Most reports document almost none of them.
An independent review works backward through that chain. It starts with the conclusion and asks what would have to be true for it to hold, then goes to the extraction and the logs to see whether it is.
Reports are challenged more often on what was never examined than on what was examined wrong.
Questions
What a review answers
- Was the methodology sound. Was the acquisition method appropriate for the device and the question, was the right scope collected, and would another examiner following the stated procedure arrive at the same place.
- Was the evidence handled defensibly. Write blocking, hash values recorded at acquisition and verified later, custody documented at each handoff, and whether the report supplies enough of that record to be checked at all.
- Does the source data support the conclusion. The most common defect is not a false artifact. It is a real artifact carrying more weight than it can bear, with the gap between observation and inference left unmarked.
- What was not examined. Devices, accounts, date ranges, and artifact categories that were available and went unreviewed, and whether their absence changes what the remaining evidence means.
Scope
What gets reviewed
The report
Findings traced back to the artifacts cited for them. Where a conclusion rests on an artifact that does not carry it, or on no cited artifact at all, that is identified and explained in plain terms.
The extraction
Where the underlying image or extraction is produced, it is examined directly rather than accepted through the other side's summary. Independent parsing frequently surfaces records the original review did not report.
Screenshots and exhibits
A screenshot is a rendering, not a record. What application produced it, what time zone it displays, what it cropped, and whether the underlying data still exists in a form that can be verified.
Tool output and logs
Tool name, version, parser behavior, and known limitations for the device and operating system at issue. Acquisition logs and hash records, checked against what the report claims about them.
Engagement
How the work fits alongside your team
- Consulting analyst support. 4n6PI works with your legal team on the technical substance of a matter: reading productions, framing the right questions, and drafting the discovery language that gets the underlying data rather than another summary of it.
- Second opinion before you rely on a production. Before a forensic conclusion is built into a strategy, a review establishes what it actually rests on and where it is thin.
- Scoping whether a challenge is worth bringing. Some reports are careful and correct. Knowing that early is worth as much as finding a defect, and it costs a fraction of the alternative.
- Alongside the designated expert of record. Where a matter calls for one, 4n6PI works alongside the expert your firm designates, supporting that role in a consulting capacity rather than occupying it.
A review that finds nothing is still a result
Work is not scoped to produce a defect. If the other side's methodology holds and the data supports what was concluded, that is what the review says, and you have a clearer picture of the matter than you had the week before. A review written to reach a predetermined answer is worth nothing to the party that paid for it.
Pricing
Billed hourly, scoped before it starts
Independent review and consulting analyst support are billed at $150 per hour. The first conversation is free. Send what you have, whether that is a full report with exhibits or three pages and a bad feeling, and we will tell you what a review would cover and roughly what it would take.
Where the review turns into an examination of your own client's devices, that work is priced on the published flat rates for forensic collection. A standing retainer puts terms in place before the next matter arrives, at no cost to establish.
Send us the report
Thirty minutes with the document is usually enough to say whether there is something in it worth pursuing, and that conversation costs nothing.