About & Contact
Write to Quinn,
not a sales pipeline.
Tell us what is happening and we will reply in writing. Every engagement is NDA-protected. If your case is a good fit, we'll scope an engagement in writing. If a simpler step would resolve it, we'll tell you that and decline. We'd rather lose the case than waste your money.
About Quinnlan Varcoe
The examiner who reads your message.
I'm Quinnlan Varcoe. I founded SleuthX in 2022 after a decade of incident response and threat intelligence work for Fortune 50 enterprises and the defense industrial base. I hold 9 active certifications across GIAC.
I started this practice because the people who actually need DFIR work, individuals being stalked, attorneys preparing for trial, family offices after a wire fraud, and small businesses hit by ransomware, were getting the worst of an industry built for billion-dollar enterprise contracts. Either they were priced out, or they were sold automated scans dressed up as investigations, or they were handed off to junior staff after the sales call. None of those outcomes are acceptable.
I scope every engagement and oversee the practitioner team executing the work. Alex Riffenburgh, our Co-Founder, brings the offensive-security discipline and takes investigations and field operations going forward. I review every case before findings leave the practice. If we are not the right fit for your case, I'll tell you, and where possible I'll refer you to someone who is.
- A direct line to Quinn, the founder, not a sales pipeline.
- Worked in-house by the examiner who scoped it.
- Explainable findings you can verify, with the methodology shown.
Who we work with
- Individuals and families facing stalkerware, account compromise, identity theft, romance scams, or domestic-violence situations involving digital evidence.
- Attorneys who need forensic phone extraction, e-discovery support, expert-witness testimony, or spoliation analysis, primarily in family law and commercial litigation.
- Family offices and HNW principals who need discreet investigative support, privacy services, and a security program ownership layer their wealth manager cannot provide.
- Investigative journalists and newsrooms facing device compromise or source-protection questions. See our work with journalists.
- Small and mid-sized businesses that need real cybersecurity without the enterprise pricetag, through managed services and incident response.
- Other security firms, MSPs, and law firms who refer cases to us or sub-contract us as a white-label partner.
What this means for you
- Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
How an engagement begins
- A written description. NDA-protected. Tell us what is happening, and Quinn reads it directly, with no sales process.
- Scoped engagement. A written proposal with a fixed fee where it applies and hourly with milestone caps for open-ended investigations.
- Examination and report. A written report with the hash values, the method, the tools and their versions, and the exhibits.
Two ways to work a case
Hand it to an examiner, or run it yourself.
Both keep a chain of custody from the first file. The difference is who does the work.
Done for you
An examiner takes the case
A credentialed examiner works the case end to end and stands behind the report.
- Who it is for: anyone in a crisis, on a deadline, or who wants the case off their plate
- What you get: a credentialed examiner, the same forensic output and chain of custody
- Your effort: hand over the devices or accounts, and we do the work
- Price and billing: Fixed fee by number of devices. You see your exact price before you sign.
Self-serve
Run it yourself
Fully automated digital forensics you run yourself. SleuthX automates a digital investigation end to end, from collecting and analysing the evidence to a report with every finding cited.
- Who it is for: hands-on people who want to see what happened for themselves
- What you get: A SHA-256 hash of every file as it is added, re-checked against the stored copy; An append-only chain-of-custody log; Every finding cited to the evidence it came from; An examiner's review when you want one
- Your effort: you add the evidence and steer the investigation
- Price and billing: $200/mo, billed monthly and renews until you cancel. Includes $200 of usage credit each month. The credit resets at the start of each billing month and does not carry over. Usage beyond it draws down a prepaid balance you top up in-app, and top-ups never expire.
Automated output is prepared to evidentiary standards. Before you rely on it in court, a qualified examiner has to review it and be able to certify the work.
Most Requested Services
Certified Expertise
GIAC
