Active Incident? 24/7 Response →
SleuthX

For Attorneys

Digital Forensics for Divorce and Family Law

Digital forensics for divorce and family law. Recover deleted texts, app data, account activity. Court-admissible documentation. Expert witness available.

Court-ready digital evidence for your divorce or custody case

When a divorce or custody case turns on what is on a phone, a laptop, or in an account, a screenshot is rarely enough — the other side can challenge where it came from and whether it was altered.

We recover and document the underlying record — deleted messages, hidden-asset and crypto trails, location and timeline data — to court-ready standards, with the methodology shown so it stands up under cross-examination.

Whether any piece of evidence is ultimately admitted is the court’s decision; our job is to make it documented, explainable, and ready for that decision.

That includes the digital trail of concealed accounts, crypto wallets, and assets moved during the marriage.

Device work runs through forensic phone extraction for divorce; where surveillance field work is needed, we use the licensed-PI infidelity investigation referral or the licensed PI surveillance referral for divorce and custody matters.

For family-law counsel:we are regularly retained directly by matrimonial and family-law attorneys and work under your direction — a written engagement letter that names you as the directing client, findings documented to court-ready standards, and an examiner who can testify to the method. Your client can also bring us in and introduce you.

Engagements are confidential and structured to begin within 48 hours of the consultation.

Some service tracks are offered at a fixed fee; complex investigations are billed hourlywith a clear scope, milestone updates, and a cap agreed up front.

Quinn (Founder and CEO) oversees every engagement and reviews every case before findings leave the practice; the practitioner team executes the technical work under her methodology.

What this means for you

How an engagement begins

  1. Confidential consultation. NDA-protected. 30-60 minutes. Direct conversation, no sales process.
  2. Scoped engagement. Written proposal with defined deliverables and pricing — fixed fee where it applies, hourly with milestone caps for open-ended investigations.
  3. Investigation and findings. Court-admissible standards. Written report you can act on.

Working out whether this is a do-it-yourself situation or a court matter? Our guide to recovering deleted text messages lays out both paths — free self-help and court-ready forensic recovery.

Why this work matters

Divorce and custody cases are decided on evidence a judge will scrutinize — so the method behind a finding has to be as defensible as the finding itself.

Quinn holds 9 active certifications across GIAC — methodology trusted by Fortune 50 enterprises,defense contractors, and the attorneys who refer to us.

Meet Your Practitioner

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 9 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response
Quinnlan Varcoe, Founder & CEO
iPhone & Android Forensics · How Acquisition Actually Works

Why iPhone forensics is hard, and what we ship to do it.

iPhone forensic acquisition is the most technically demanding work in consumer DFIR. Apple's Secure Enclave, hardware-backed encryption keys, signed-system volume, and aggressive iOS hardening between every minor release mean there is no "run a tool from the cloud and read the phone" option. Each iOS version requires updated forensic methods, and most of those methods only work with a specific physical-cable connection to a licensed acquisition platform — Cellebrite UFED, Magnet AXIOM, MSAB XRY, and the same tools used by federal law enforcement and major IR firms. When a matter calls for it, we engage these platforms through our licensed partner network.

Android is a different problem set with the same conclusion. Verified Boot, full-disk encryption, and OEM-specific lock states (Samsung Knox, Google's Titan M2, Xiaomi's mi-account lock) all gate what can be acquired and how. Every Android make and model is its own acquisition path.

Remote forensics works — but the device has to be in the lab.

We work with clients across the United States. For remote engagements, we ship you a tracked, insured, evidence-grade shipping kit — anti-static packaging, tamper-evident seals, chain-of-custody form. You package the device, drop it at the carrier, and we acquire it in our lab using the appropriate acquisition workflow for that device and OS version. Findings are written up and the device ships back to you under the same chain of custody.

Total turnaround from device-arrival to written report is typically 5 to 10 business days for a standard single-device case. Active-incident or court-deadline cases compress under surge. A screen-share, an email of screenshots, or a remote session with the user holding the phone is not a forensic acquisition — it does not preserve evidence, it does not produce a court-admissible report, and we will not represent it as such.

If the device is in active use by a hostile actor (an abuser, an active attacker), we coordinate timing of the hand-off with you to protect the integrity of the evidence and your physical safety. Tell us this on the first call.

How We Work

A confidential, structured engagement.

01

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

02

Scoped Engagement

A clear written proposal with defined deliverables, timeline, and pricing. No hidden costs.

03

Investigation and Findings

Forensic work conducted to court-admissible standards, with regular communication and a written summary you can act on.

Certified Expertise

GIAC

Frequently asked about divorce forensics

Is digital forensic evidence admissible in divorce court?
Yes, when it's collected and documented under proper forensic protocols. Every engagement we run uses court-admissible methodology — write-blocked imaging, documented chain of custody, hash-verified preservation, and a written report formatted to Federal Rules of Evidence and Daubert standards. We don't just deliver findings; we deliver findings that survive cross-examination and a Daubert challenge.
What devices and accounts can you examine?
iPhones and Android phones, Windows and Mac laptops, iCloud and Google account exports, email accounts, social media, messaging apps (iMessage, WhatsApp, Signal, Telegram), GPS history from vehicles or apps, hidden tracking devices (AirTags, Tile), home network logs, and cloud storage. We work with the original device when there is legal access to it, or with consented backups, exports, and subpoenaed records. We also tell you up front what cannot be extracted given the device, OS version, and timeframe.
Can you recover deleted text messages, photos, or app data?
Often yes, depending on the device, operating system version, and how long ago the data was deleted. iPhones and modern Android devices encrypt at rest, which limits some recovery methods, but artifacts persist in iCloud backups, app caches, system logs, and deleted-file slack space. We use Apple-native and platform-native workflows, and when a matter calls for it, industry-standard tooling like Cellebrite and Magnet AXIOM through our licensed partner network. We give you a realistic recovery probability for your specific situation in the consultation, before you commit to an engagement.
How much does a divorce-related forensic investigation cost?
You have two ways to work with us. Run the investigation yourself in the SleuthX tool for $995 once — lifetime access, with usage metered from a prepaid balance you top up anytime. Or have our team do it for you in a done-for-you device package: $3,000 for one device, $7,000 for three, $12,000 for five, each including the $995 lifetime license. Anything beyond a package — more devices, or complex multi-device and longstanding cases — is scoped per case at a flat $400/hr, with no multipliers. Sliding-scale arrangements are available for survivors of domestic violence and clients with limited resources — that conversation happens on the first consultation.
How long does a typical engagement take?
A focused single-device forensic extraction usually runs 5–10 business days from device receipt to written report. Complex investigations involving multiple devices, cloud accounts, and timeline reconstruction typically run 3–6 weeks. If you have a court hearing, deposition, or mediation deadline, the engagement is structured around that date.
Will my spouse know I had their device or accounts examined?
That depends on whether there is legal access to the device or account. Forensic examinations performed without legal access are not work we will take — that is both an ethical line for the practice and a federal Computer Fraud and Abuse Act issue that can compromise your divorce case. We work with devices and accounts you legally co-own or have consent to examine, or alongside your attorney to obtain devices through subpoena or court order. The practice does not perform covert spyware deployments or unauthorized account access.
Do you work directly with my attorney?
Yes, and we strongly prefer to. Most divorce-forensics engagements are billed under your attorney's privilege with a written engagement letter that names your attorney as the directing client. This protects the work product, keeps findings admissible, and ensures the investigation supports your legal strategy. We are regularly retained directly by family-law and matrimonial attorneys; your lawyer can also introduce us if that is easier.
Quinnlan Varcoe, Founder & CEO
Quinnlan Varcoe
GIAC-certified · Founder & CEO

Schedule Your Session

Schedule a confidential consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process. Most engagements begin within 48 hours.

Free, confidential · NDA-protected · no obligation.

  1. 1. Book a 15-minute call — we scope your situation, no charge.
  2. 2. You get a written scope — deliverables, timeline, and price — before any work begins.
  3. 3. Approve it and we start; most engagements begin within 48 hours.

Transparent pricing

Trusted by partners across the practice

DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management
DAS Health
Exhibit A Cyber
Ally Security
KIRO Group
Black Mirage
Kalles Group
Gridware
CQR
Archstone Security
Cyvergence
Sentinel Cyber
Cloud Underground
Seron Security
Hexen
Koru Risk Management