Family law

Digital forensics for family law, divorce and custody cases

Texts, app data and account history from devices you own, documented in a report your family law attorney can review.

Digital evidence for your divorce or custody case

When a divorce or custody case turns on what is on a phone, a laptop, or in an account, a screenshot is rarely enough, because the other side can challenge where it came from and whether it was altered.

We examine only a device you own. Before we start, you sign a form stating that you own it. On that device we examine and document the messages, including deleted ones it still holds, the hidden-asset and crypto trails, and the location and timeline data underneath, with the method written down so your attorney can explain it.

Whether any piece of evidence is ultimately admitted is the court’s decision; our job is to make it documented, explainable, and ready for that decision.

That includes the digital trail of concealed accounts, crypto wallets, and assets moved during the marriage.

Device work runs through forensic phone extraction for divorce; where surveillance field work is needed, we use the licensed-PI infidelity investigation referral or the licensed PI surveillance referral for divorce and custody matters.

For family-law counsel: we work under your direction, on a written engagement letter that names you as the directing client, with findings documented and the method shown. Your client can also bring us in and introduce you.

Some service tracks are offered at a fixed fee; complex investigations are billed hourly with a clear scope, milestone updates, and a cap agreed up front.

Quinn (Founder and CEO) oversees every engagement and reviews every case before findings leave the practice; the practitioner team executes the technical work under her methodology.

What this means for you

How an engagement begins

  1. Confidential consultation. NDA-protected. 30-60 minutes. Direct conversation, no sales process.
  2. Scoped engagement. Written proposal with defined deliverables and pricing, a fixed fee where it applies and hourly with milestone caps for open-ended investigations.
  3. Investigation and findings. Documented method. Written report you can act on.

Working out whether this is a do-it-yourself situation or a court matter? Our guide to recovering deleted text messages lays out both the free self-help path and the forensic examination.

Why this work matters

Divorce and custody cases are decided on evidence a judge will scrutinize, so the method behind a finding has to be as defensible as the finding itself.

Quinn holds 9 active certifications across GIAC, a methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us.

Fixed fee by number of devices. You see your exact price before you sign.

Call (239) 241-8095
iPhone & Android Forensics · How Acquisition Actually Works

Why iPhone forensics is hard, and what we ship to do it.

iPhone forensic acquisition is the most technically demanding work in consumer DFIR. Apple's Secure Enclave, hardware-backed encryption keys, signed-system volume, and aggressive iOS hardening between every minor release mean there is no "run a tool from the cloud and read the phone" option. Each iOS version requires updated forensic methods, and most of those methods only work with a specific physical-cable connection to a licensed acquisition platform such as Cellebrite UFED, Magnet AXIOM, MSAB XRY, the same tools used by federal law enforcement and major IR firms. When a matter calls for it, we engage these platforms through our licensed partner network.

Android is a different problem set with the same conclusion. Verified Boot, full-disk encryption, and OEM-specific lock states (Samsung Knox, Google's Titan M2, Xiaomi's mi-account lock) all gate what can be acquired and how. Every Android make and model is its own acquisition path.

Remote forensics works, but the device has to be in the lab.

We work with clients across the United States, and every acquisition happens in the lab, using the acquisition workflow for that device and OS version. The agreement you sign explains how to hand over or ship your device.

Most examinations are finished one to two weeks after you sign, provided your devices reach us promptly. If you need it sooner, ask us to rush it. A screen-share, an email of screenshots, or a remote session with the user holding the phone is not a forensic acquisition. It does not preserve evidence, it does not produce a forensic report, and we will not represent it as such.

If the device is in active use by a hostile actor (an abuser, an active attacker), we coordinate timing of the hand-off with you to protect the integrity of the evidence and your physical safety. Tell us this when you first get in touch.

How We Work

A confidential, structured engagement.

01

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

02

Signed Engagement

The price is fixed by the number of devices. Before any work starts, you sign the agreement and the chain-of-custody form.

03

Examination and Report

A named examiner works the devices and accounts you sent and writes a report with the hash values, the method, the tools and their versions, and the exhibits.

Certified Expertise

GIAC

Frequently asked about divorce forensics

What does it cost, and can I pay over time?
A device examination is a fixed price set by the number of devices: one, two to three, or four to five. Each price includes a set number of examiner hours. You can start with one device, and you can ask about paying over time. You see your exact price before you sign.
Where are you, and do I have to send my phone?
We are based in Naples, Florida, and examine devices in Naples and in California. Before any work starts you sign one page: the agreement and the chain-of-custody form. The agreement you sign explains how to hand over or ship your device.
What if the examination finds nothing?
We do not promise a result. You get a written report on completion covering each device and each account you sent, whatever it shows.
Can you show who did it?
An examination can show what happened on a device or account, and when. It often cannot show who was behind it, and we will not tell you it can.
Will police, a court or my lawyer take it seriously?
We cannot promise how police, a court or a lawyer will treat the report. We can tell you what it contains: the hash values, the method, the tools and their versions, and the exhibits.
What happens next, and how long does it take?
You sign the engagement letter, and your card is charged when you sign. Most examinations are finished one to two weeks after you sign, provided your devices reach us promptly. If you need it sooner, ask us to rush it.
Is this a person or an AI?
This line is answered by the SleuthX team, and by the SleuthX assistant, an AI, when the team cannot pick up. A named examiner examines your device and signs the report.
Whose device can you examine?
We examine only a device you own. Before we start, you sign a form stating that you own it. If that statement is false, the evidence can become unusable in court.
Will my spouse know I had their device or accounts examined?
We examine only a device you own. Before we start, you sign a form stating that you own it. Forensic examinations performed without legal access are not work we will take. That is both an ethical line for the practice and a federal Computer Fraud and Abuse Act issue that can compromise your divorce case. Records you do not own are reached through your attorney, with consent or by subpoena or court order. The practice does not perform covert spyware deployments or unauthorized account access.
Do you work directly with my attorney?
Yes, and we strongly prefer to. The written engagement letter can name your attorney as directing the work, so the findings are documented for your attorney and the work stays aligned with your legal strategy. Your lawyer can also introduce us if that is easier.

Ways to work with us

Self-serve tool

$200/mo billed monthly

Fully automated digital forensics you run yourself. SleuthX automates a digital investigation end to end, from collecting and analysing the evidence to a report with every finding cited.

See what's included →

Done-for-you

Device packages for 1 to 5 devices. Fixed fee by number of devices. You see your exact price before you sign.

Call (239) 241-8095

Enterprise

$200/seat/mo plus $5/device/mo

Team tier, with frontier reasoning, analyst escalation, and team billing.

See enterprise →

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management