SleuthX Field Notes
Plain-language notes from the work.
What we publish here is the actual material we wish more clients had read before the engagement began. No SEO fluff. No fear-marketing. Real answers to the questions buyers are typing into Google.
Family Office·8 min read
Why a Family Office Is a Bigger Cyber Target Than a Corporation
Comparable wealth to a large company, a fraction of the controls, and a public principal. The asymmetry is the whole point, and it is fixable.
Read article →For Attorneys·8 min read
Geofence and Cell-Tower Location Evidence, Explained
Location evidence is powerful and easy to overstate. Geofence after the Supreme Court's Chatrie decision, cell-site under Carpenter, and why tower mapping is approximate.
Read article →For Attorneys·7 min read
Expert Witness vs. Collection Vendor: Which Do You Actually Need?
Hiring a vendor and assuming they can testify is how a case ends up with data and no admissible opinion. The two roles, the Rule 702 gap, and when you need each.
Read article →For Attorneys·9 min read
How to Authenticate Text Messages in Court (FRE 901 & 902)
A low prima-facie bar, two self-authentication shortcuts with a notice trap, and the case law that says a name on a screenshot proves nothing about who wrote it. Written for family-law and litigation counsel.
Read article →Family Office·9 min read
Stopping Wire-Transfer Fraud in a Family Office: A Controls Checklist
Most wire fraud is stopped by process, not technology. Here is the short list of controls that quietly close the gap most family offices leave open.
Read article →For Attorneys·8 min read
How to Vet and Qualify a Digital Forensic Expert (Daubert Checklist)
Credentials get an examiner in the door; reproducible methodology keeps the testimony in. A Daubert-built checklist for vetting a digital forensic expert.
Read article →For Attorneys·8 min read
Screenshots Aren't Enough: Why Family-Law Texts Need a Forensic Extraction
The other side's screenshot is easy to make and easy to attack. Here's the authorship gap the case law cares about, and what a forensic extraction adds that a phone-camera photo never can.
Read article →For Individuals·8 min read
If Your Teen Is Being Sextorted: A Parent's Guide
A calm, step-by-step guide for parents: what financial sextortion is, why your teen is not to blame, and the free help from NCMEC and Take It Down, without the panic.
Read article →For Individuals·8 min read
How to Get an Intimate Image Taken Down
You do not have to pay anyone to get an intimate image removed. Here are the free tools that actually work, and how to preserve evidence and avoid takedown scams first.
Read article →For Individuals·7 min read
Freeze Your Credit and Lock Your SIM: Two Free Shields
Two of the strongest protections against identity theft and SIM-swap fraud are free and take minutes: a credit freeze and a carrier port-out PIN. Here is how to set both.
Read article →For Individuals·6 min read
What Is a SIM Swap? Warning Signs and What to Do
A SIM swap is rare but serious: your number is moved to an attacker's SIM and your text codes go with it. The signs, the first moves, and an honest read on the odds.
Read article →For Individuals·8 min read
Identity Stolen? Your First 48 Hours, Step by Step
Move in the right order and you limit the damage. The official FTC sequence for the first 48 hours after your identity is stolen, with the honest caveats.
Read article →For Individuals·7 min read
Recover Deleted Texts: Android vs iPhone
iPhone and Android handle deleted texts very differently. Here is what each lets you recover yourself, and the truth about what a carrier can and cannot give you.
Read article →For Individuals·8 min read
Recover Deleted WhatsApp, Signal and Snapchat Messages
Whether you can get a deleted chat back depends almost entirely on which app it was in. WhatsApp has a backup path; Signal and Snapchat usually do not.
Read article →For Individuals·7 min read
How to Recover Deleted Photos on iPhone and Android
If you act inside the trash window, getting deleted photos back is easy. After it closes with no backup, it is usually impossible. Here is an honest account of why.
Read article →For Individuals·8 min read
Is Someone Reading My Texts? Myths vs Real Ways It Happens
Calm version first: a stranger cannot grab your texts out of the air with just your number. Here are the myths, the few real vectors, and a check for each.
Read article →For Individuals·9 min read
Hidden Trackers Beyond AirTags: Tile, SmartTags, and Car GPS
Phone alerts for unknown AirTags are now common. Tile, Samsung SmartTags, and cellular car GPS trackers often slip through. Here is what each one does and how to check.
Read article →For Individuals·9 min read
Gathering Evidence Safely for a Protective Order
Documenting abuse can strengthen a protective-order petition, but only if you do it without escalating danger. How to preserve evidence on a safe device, and what the court actually weighs.
Read article →For Individuals·8 min read
You Found Spyware on Your Phone — What to Do (and Not Do)
The instinct is to delete it immediately. On a monitored device that can be the most dangerous move. Here is the safety-first sequence: plan, preserve, then remove.
Read article →For Individuals·8 min read
Stalkerware vs Parental-Control Apps: What's the Difference?
One app, two marketings. The difference between a parental-control tool and stalkerware is consent and who is being monitored. Here is how to tell, and what the law says about covertly monitoring an adult.
Read article →For Individuals·9 min read
Signs Your Android Is Being Monitored (and How to Check Safely)
Android monitoring apps abuse Accessibility and device-admin permissions, not the iPhone's configuration profiles. Here are the real signs, and why to make a safety plan before you remove anything.
Read article →For Individuals·7 min read
Coinbase or Crypto Exchange Account Hacked? Emergency Steps
Lock the account, contact the exchange, harden your login, in that order. Then the hard truth about what is recoverable, and the second scam already waiting for you.
Read article →For Individuals·8 min read
Bank or PayPal Account Hacked? What to Do and Your Rights
With money accounts, the clock decides how much you're on the hook for, not the password. Here are the exact federal timelines and the order to work the problem.
Read article →For Individuals·8 min read
How to Secure Any Account After It's Been Hacked
The principles that apply to every account, not just email: the order to work them, why a malware scan can come first, and where to go for each major platform's specific steps.
Read article →For Individuals·7 min read
Is SMS 2FA Safe? Why Text-Message Codes Are the Weakest Link
Any second factor beats a password on its own. But a text-message code is the one a determined attacker can steal without ever touching your phone. Here's the ladder up.
Read article →For Individuals·6 min read
Is a Hacker Still Reading Your Email After a Password Change?
A new password closes the front door. A forwarding rule the attacker left behind is the open window. Here's the one check most people skip, and why it matters.
Read article →For Individuals·7 min read
Account Hacked but You Still Have Access? Do This First
If you can still get in, you hold the advantage, but only until the attacker changes your password. Here's which of the two paths you're on, and the first moves on each.
Read article →For Individuals·6 min read
Gift-Card and Zelle Scams: Why Scammers Love Them
"Pay with gift cards" is a tell, not a request. Once the codes are read aloud the money is usually gone. There are still steps worth taking right away.
Read article →For Individuals·7 min read
Tech-Support Scams: The Fake "Your Computer Is Infected" Call
No real company freezes your screen and tells you to call a number. Here is how the fake-support scam works, and the steps to take if you already gave them access.
Read article →For Individuals·7 min read
Romance-Scam Red Flags (Before You Lose Money)
This is the pre-loss guide: how to tell a real connection from a script before any money moves. If money is already gone, the recovery guide is a separate read.
Read article →For Individuals·6 min read
How to Report a Scam (Free, Step by Step)
Reporting will not usually get your money back by itself, but it builds the record every later step depends on. Here are the three free channels and how to use them.
Read article →For Individuals·8 min read
Real-Estate Closing Wire Fraud: How It Happens
Days before closing, an email with "updated" wire instructions arrives. It looks like your title company. It is not. Here is how the scam works and how to stop it.
Read article →For Individuals·8 min read
You Wired Money to a Scammer: The First 24 Hours
Speed is everything. A wire can sometimes be recalled if the banks act fast enough. Here is exactly who to call, in what order, in the first day.
Read article →For Individuals·6 min read
The Grandparent Scam Now Uses AI Voice Cloning
A few seconds of audio from social media is enough to clone a voice. The "grandchild in jail who needs bail money now" call has never sounded more real.
Read article →For Individuals·8 min read
My Parent Was Scammed — What to Do Now
Older adults lost billions to fraud last year. If it just happened to your parent, move calmly through these steps. Report, protect, preserve, without blame.
Read article →For Individuals·6 min read
Pig-Butchering Warning Signs to Catch It Early
A wrong number that becomes a friendship. An investment that only goes up. A withdrawal that needs one more deposit in "tax." Here is the pattern, flag by flag.
Read article →For Individuals·7 min read
What Is Pig Butchering? A Plain-English Explainer
The name comes from "fattening the pig before slaughter." The scammer builds trust for weeks, then steers you onto a fake trading platform that shows fake gains.
Read article →For Individuals·7 min read
Can Stolen Crypto Be Recovered? The Honest Odds
Recovery is possible in a narrow set of cases. Regulated institutions, fast action, funds not yet withdrawn. Outside that, be very skeptical of anyone promising a refund.
Read article →For Individuals·6 min read
Crypto Recovery Services Are Usually a Second Scam
The blockchain transaction is final, and the "recovery expert" who contacted you after the scam is the same network running it again. Here is the honest version.
Read article →Family Office·7 min read
Can Someone Deepfake the Principal's Voice to Approve a Wire?
Hearing a familiar voice is no longer proof of who is calling. The Arup case shows why, and it points to the out-of-band control that still works.
Read article →For Attorneys·7 min read
Challenging the Other Side's Forensic Report: A Rebuttal Primer
The durable challenge goes after the method and the reasoning, not the person. Joiner's analytical gap, the Rule 702 clauses to push, and Rule 705 disclosure.
Read article →For Attorneys·8 min read
How Much Does a Digital Forensic Exam Cost in a Divorce Case?
Why no honest examiner quotes a flat number sight-unseen: the drivers that set the cost of a divorce forensic exam, the scoped-quote norm, and how SleuthX's pricing works.
Read article →Family Office·8 min read
Business Email Compromise Against Wealthy Families: How It Works
BEC is not a virus. It is a patient con run through your own inbox. Here is the kill chain, told from the family's side of it.
Read article →For Attorneys·7 min read
What Goes Into a Court-Admissible Forensic Report
A report is an argument with a paper trail, and the paper trail decides admissibility. The elements a credible forensic report carries, mapped to the rules of evidence.
Read article →For Attorneys·8 min read
Can Deleted Texts Be Recovered for a Custody Case?
Recovered co-parenting texts can move a best-interests analysis, but only if they still exist on the device. The honest limits, and when the exam earns its cost in a custody case.
Read article →Family Office·8 min read
Do We Need a Fractional Family-Office CISO? A Decision Guide
Not every family office needs a security chief, but the ones that do usually find out the expensive way. Here is how to decide before that.
Read article →For Attorneys·8 min read
Chain of Custody for Digital Evidence, Explained for Litigators
Who touched it, when, and how you can prove it. What a defensible custody record documents, how hashes prove integrity, and how to attack a broken chain.
Read article →For Attorneys·8 min read
The Hearsay Trap: When Text-Message Evidence Gets Thrown Out
Good evidence dies on a hearsay objection counsel could have answered. The party-opponent exclusion, the exceptions that get texts in, and when a message isn't hearsay at all.
Read article →Family Office·9 min read
Household Staff & Insider Risk: The Family-Office Blind Spot
The likeliest source of a quiet loss is rarely a stranger overseas. It is someone with a key. Handled with care, the risk is manageable.
Read article →For Attorneys·8 min read
E-Discovery vs. Digital Forensics: What's the Difference, and Which Do I Need?
Same evidence, two different depths. E-discovery scales across documents; forensics goes deep on a device. How to scope the question before you scope the spend.
Read article →For Attorneys·9 min read
Sending a Litigation Hold for a Phone: A Family-Law Template
Spoliation is cheaper to prevent than to sanction. A family-law preservation-letter template, when the duty attaches, and the Wiretap/SCA/CFAA lines that say preserve your own and never break into theirs.
Read article →Family Office·8 min read
Digital Executive Protection, Explained: What It Covers Beyond Corporate IT
The principal's real attack surface is at home, on personal accounts, and across the family, exactly where the corporate security program does not reach.
Read article →For Attorneys·8 min read
Collecting Text Messages and Mobile Data for E-Discovery (Defensibly)
Mobile data is discoverable and easy to spoil. The preservation and collection duties, why unsupervised self-collection draws sanctions, and what defensible looks like.
Read article →For Attorneys·9 min read
Finding Hidden Assets in Divorce: What a Phone or Computer Reveals
A forensic exam tells you where to look, not where the money is. The indicators that point discovery and subpoenas at concealed accounts, framed honestly about what depends on the device and the user's habits.
Read article →Family Office·9 min read
How to Get a Principal's Home Address & Family Off the Internet (Doxxing Defense)
You can shrink a principal's exposure a great deal, but not to zero. Here is what works, in what order, and where the honest limits are.
Read article →For Attorneys·8 min read
Slack, Teams and Ephemeral-Messaging Discovery: What's Recoverable
The platforms changed; the duty to preserve did not. What's recoverable from Slack and Teams, and how auto-delete after a duty attached becomes spoliation.
Read article →For Attorneys·9 min read
iCloud & Google Backups as Evidence: What Counsel Can and Can't Subpoena
A backup outlives a factory reset, but content is warrant-protected, and a civil subpoena to a provider does not reach it. What counsel can actually compel, and from whom, in family court.
Read article →Family Office·9 min read
Is the Principal Being Tracked? AirTags, Jet/Yacht Tracking & Geotags
A principal's location often leaks in public, no spyware required, from a tag in a bag to a tail number on a flight tracker. Here is how to find and close each gap.
Read article →For Attorneys·7 min read
A Small-Firm Guide to ESI from Phones and Cloud Apps
You don't need an enterprise budget to run a defensible small-case ESI process. Proportionality is the lever: preserve broadly, collect narrowly, analyze deeply only where it counts.
Read article →For Attorneys·8 min read
What Digital Evidence Actually Proves in a Custody Fight
Judges weigh patterns, not single screenshots. The categories of digital evidence that carry weight in a custody case, and the authentication that keeps them from being excluded.
Read article →Family Office·8 min read
Protecting a Principal's Children Online: A Family-Office Playbook
Children are the softest target around a wealthy family. The fixes are mostly quiet, practical, and worth doing before anything happens, not after.
Read article →For Attorneys·8 min read
Digital Evidence in Criminal Defense: How to Challenge a Phone Extraction
A phone extraction is not self-proving. Two levers for the defense: warrant scope under Riley, and the reliability of the tool, the method, and the interpretation.
Read article →For Attorneys·8 min read
Recovering Deleted Photos & Location Data for a Family-Law Case
Photos and location can corroborate a timeline a witness won't, when they still exist. The honest windows, why location data lives on the device, and the cross-examination traps in EXIF.
Read article →Family Office·9 min read
Deepfake Impersonation of a Public Figure: Detection & Takedown
A convincing fake of the principal is now a routine reputational risk. Handled methodically, it is also a solvable one: document, preserve, take down, escalate.
Read article →For Attorneys·8 min read
Authenticating Social-Media Evidence (Facebook, Instagram, TikTok) for Trial
The account existed, but who wrote the post? The distinctive-characteristics route under Rule 901, the Griffin–Tienda–Sublet split, and the SCA subpoena wall.
Read article →Family Office·8 min read
Reputation & Privacy After a Breach Exposes a Wealthy Family
The hours after a family's data leaks set the tone for everything that follows. A measured, sequenced response contains the damage; panic compounds it.
Read article →Family Office·8 min read
A Wealth Advisor's Guide to Vetting a Family Cybersecurity Firm
A bad referral reflects on the advisor who made it. Here is how to tell a credible family-security firm from a merely confident one, before you introduce a client.
Read article →For Individuals·8 min read
Romance Scam Recovery: What Forensics Can and Cannot Recover
If someone promised they could recover the money, walk away. Here is what a real forensic investigation looks like, and what it can actually deliver.
Read article →For Individuals·7 min read
How to Tell If Someone Installed Stalkerware on Your iPhone
If you suspect someone is reading your messages, the apps in the App Store will not tell you. Here is what does.
Read article →For Individuals·7 min read
Is Your Email Hacked? 10 Signs and How to Verify Forensically
Most people change their password and assume the problem is over. The attacker is usually still there. Here is what to actually check.
Read article →For Individuals·6 min read
AirTag Stalking: How to Detect One and What to Do
AirTags ping your phone after a few hours of separation from their owner, but only if your phone trusts them. Here is what does and does not trigger an alert, and how to find one that did not.
Read article →For Individuals·8 min read
Is Your Spouse Cheating Digitally? Forensic Signs vs Paranoia
If you are reading this, the answer is usually yes. Here is what to look for, what to preserve, and what not to do. The wrong DIY move can destroy your case in family court.
Read article →Concepts·11 min read
What Does a Digital Forensics Investigation Actually Look Like?
The TV version is wrong, the marketing version is worse. Here is what an actual forensic case looks like from intake to court-ready report.
Read article →Small Business·10 min read
Small Business Cybersecurity Checklist (Under 50 Employees)
Most small business cybersecurity guides are vendor checklists in disguise. This one is what we actually tell clients to do, in priority order.
Read article →Small Business·9 min read
Hit by a BEC Scam? The First 48 Hours for Small Businesses
Wire fraud via fake invoice or vendor switch hits small businesses hardest. The recovery window is days, not weeks. Here is the playbook.
Read article →For Attorneys·9 min read
Can Deleted Text Messages Really Be Recovered for Court?
What recovers, what doesn't, and what your judge will accept. Written for family-law and litigation counsel.
Read article →For Attorneys·10 min read
Spoliation in Family Law: Sanctions When the Other Side Deletes Digital Evidence
When the other side wipes a phone two days after the preservation letter, you have a case for sanctions. Here is what your forensic expert needs to find and how to present it.
Read article →Family Office·11 min read
Family Office Cybersecurity: 10 Risks Most Wealth Managers Miss
Most family offices have a CFO running the security program by accident. Here is what they are missing, and what a single incident actually costs.
Read article →Family Office·8 min read
Sextortion of Executives and HNW Individuals: A Forensic Response Playbook
Paying makes it worse. Posting a public statement makes it worse. Here is what actually works: quietly, quickly, and with evidence preserved for the prosecution that may follow.
Read article →About the field notes
What kind of content does SleuthX publish?
Who writes the blog?
How often is the blog updated?
Can I share or quote these posts?
Where do I go if I need actual help, not just a guide?
Schedule Your Session
Need a case worked, not an article read?
Direct conversation with Quinn. NDA-protected. Most engagements begin within 48 hours.
Free, confidential · NDA-protected · no obligation.
- 1. Book a 30-minute call — we scope your situation, no charge.
- 2. You get a written scope — deliverables, timeline, and price — before any work begins.
- 3. Approve it and we start; most engagements begin within 48 hours.
