All articles·11 min read·April 23, 2026

What it actually is

Digital forensics is the discipline of recovering, preserving, analyzing, and presenting digital evidence in a way that survives legal scrutiny.

It applies to computers, phones, cloud accounts, network logs, surveillance video, and increasingly to vehicles and IoT devices.

The deliverable is not "I looked at it."

The deliverable is a chain-of-custody documented written report that a court will accept.

The phases of an actual case

1. Intake and preservation

Before anyone touches the device, we document its state with photos, its location, who handed it over, when, and in what condition.

The device is then either imaged on-site (forensic write blocker prevents any modification) or transported under sealed evidence custody.

The original device is preserved untouched; all subsequent work happens against the forensic image.

2. Hashing

Before and after imaging, we calculate cryptographic hashes (SHA-256, MD5) of the device and the image.

Matching hashes prove the image is bit-for-bit identical to the original.

This is the foundation of admissibility. Without it, opposing counsel can argue the evidence was altered.

3. Artifact analysis

We parse the image with forensic tools (Autopsy, custom tooling, and, when a matter calls for it, Cellebrite, Magnet Axiom, and FTK through our licensed partner network) to extract:

Deleted files and free-space remnants
Browser history, including private/incognito sessions where artifacts persist
Application data such as messages, photos, location history, and transaction logs
System logs such as power events, USB connections, and network associations
Cloud sync artifacts showing what synced when, and from which device
Anti-forensic activity such as wipers, secure-delete usage, and timestomping

4. Timeline reconstruction

Most cases hinge on timeline.

Did message X arrive before file Y was deleted?

Was the device in location Z at time T?

We assemble a master timeline correlating events across multiple artifact sources, surfacing inconsistencies that suggest user behavior or suggest evidence has been tampered with.

5. Reporting

The report is written for the audience: a court, an attorney, a regulator, or in consumer cases, the client themselves.

It includes:

Statement of qualifications (the certifications that make findings admissible)
Methodology, with what tools, what versions, and what configurations
Chain of custody, with every hand-off documented
Findings stated factually, with citations to specific artifacts
Limitations, covering what we could not determine and why
Exhibits such as screenshots, hash records, and raw data references

6. Testimony (when needed)

For matters going to deposition or trial, the investigator becomes a qualified expert witness, voir dired, cross-examined, and expected to defend every methodology choice.

Reports written without that eventual scrutiny in mind do not survive it.

What separates real forensics from "tech consulting"

Write blockers. If they didn't use one, the evidence is contaminated.
Documented chain of custody. Names, signatures, timestamps for every hand-off.
Tool licensing. Court-accepted tools are expensive. Free-tool-only investigations face admissibility challenges in many jurisdictions.
Practitioner credentials. GCFE, GCFA, EnCE, CCE, CFCE. The alphabet soup matters in court.
Honest scope. A real forensic practice will tell you what they cannot determine. Anyone who promises certainty before looking at the evidence is selling something else.

Common case types we run

Personal forensics for stalkerware, account compromise, and evidence preservation in protective-order matters
Attorney-led litigation support for divorce, custody, IP theft, and employment disputes
Enterprise incident response for ransomware, BEC, and insider data theft
Insider threat and fraud for financial crimes, sabotage, and exfiltration

Related services

Self-serve forensic tool

Want professional help with a digital forensics investigation?

$995 once. Lifetime license

Run SleuthX yourself. Every tool unlocked, no subscription.

Start in the app Book a triage call

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 9 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response

Digital forensics process: frequent questions

What are the steps of a digital forensics investigation?

Six phases. Intake and preservation, where the device state is documented and the device is imaged with a forensic write blocker. Hashing, where SHA-256 and MD5 hashes prove the image is bit-for-bit identical to the original. Artifact analysis, where forensic tools parse the image for deleted files, browser history, application data, system logs, cloud sync artifacts, and anti-forensic activity. Timeline reconstruction across artifact sources. Reporting written for the audience that needs it. And testimony at deposition or trial when the matter goes that far.

How long does a digital forensics investigation take?

A focused single-device case for an individual typically runs across one to three weeks from intake to written report. Litigation-grade matters with multiple devices, cloud account preservation, and expert-witness availability run longer, often four to eight weeks before the report is final. Enterprise incident-response engagements are different again, with containment work measured in hours and full forensic reporting measured in weeks. The first call scopes the engagement, including the realistic timeline given the devices, the legal posture, and the audience for the report.

What does a digital forensics investigation cost?

Most engagements are scoped on hourly rates with a retainer. Individual cases involving one device and a written report typically land in a defined range we quote after a confidential intake call. Litigation engagements with multiple devices, expert testimony, and cross-examination preparation run higher because the work is broader and the report has to survive court scrutiny. We do not quote fixed-fee on forensic work as a default because scope changes with what the evidence shows. We do quote ranges up front so the budget is realistic before the engagement begins.

What deliverables do I receive at the end of a forensic engagement?

A written report containing the statement of qualifications, the methodology including tools and tool versions, chain of custody for every device handled, findings stated factually with citations to specific artifacts, a limitations section explaining what could not be determined and why, and exhibits including screenshots and hash records. For litigation matters, the report is structured to support expert testimony, and the examiner is available for deposition and trial. For non-litigation engagements, the report is written for counsel, an HR department, or the client directly.

What separates real digital forensics from regular IT or tech consulting?

Five things. Use of forensic write blockers so the original evidence is not modified during imaging. Documented chain of custody with names, signatures, and timestamps for every hand-off. Tool licensing for court-accepted tools like Cellebrite, Magnet Axiom, and FTK, because free-tool-only investigations face admissibility challenges in many jurisdictions. Practitioner credentials such as GCFE, GCFA, EnCE, CCE, or CFCE that the court actually recognizes. And honest scope, including a clear statement of what the examiner cannot determine. Anyone promising certainty before looking at the evidence is selling something else.

Can the results of a digital forensics investigation be used in court?

Yes, when the work was performed with admissibility in mind from the first hour. That means proper preservation, hash verification, documented chain of custody, court-accepted tools, a qualified examiner, and a report structured to meet the relevant rules of evidence. Authentication under FRE 901 or the state equivalent is the standard, and Rule 902(14) self-authentication is now available in some federal courts for digital evidence accompanied by a qualified person's certification. Reports written without admissibility in mind can be excluded, which is why selecting the examiner up front matters.

Do I need an attorney to hire a digital forensics investigator?

It depends on the case type. Civil and family-law matters work best when counsel retains the examiner under attorney-work-product privilege, because findings remain protected through discovery. For employment investigations and personal-cybersecurity matters where there is no anticipated litigation, the client can engage directly. For criminal-defense work, counsel always retains. For business incident response, the engagement can begin directly with the business and counsel can be looped in once the contours of the matter are clear. The first call usually clarifies which path is right.