What this service does
This is forensic work scaled to a person, not a corporation: your phone, your laptop, your email and cloud accounts, and the digital evidence that matters when something has gone wrong. The same forensic methods Fortune 50 legal teams rely on, applied to a hacked account, suspected tracking, a scam, or a divorce, custody, or harassment matter where what happened has to be documented.
Based in Naples, Florida. We work with clients anywhere, and examinations happen in Naples, FL and California. See digital forensics in Naples, FL for local engagements. Common tracks include stalkerware detection and removal, hacked account investigation, and identity theft investigation.
Not sure which fits? Start at our triage hub for individuals. When a matter needs licensed field work such as surveillance, locates, or service of process, we coordinate with a licensed private investigator. For a divorce or custody matter, see our forensic services for law firms. Engagement options and fees are on pricing.
Engagements are confidential. A device examination is a fixed price set by the number of devices, and anything beyond a package is scoped in writing before you sign. Quinn (Founder and CEO) oversees every engagement and reviews every case before findings leave the practice; the practitioner team executes the technical work under her methodology.
- A direct line to Quinn, the founder, not a sales pipeline.
- Worked in-house by the examiner who scoped it.
- Explainable findings you can verify, with the methodology shown.
What this means for you
- Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
Will a court accept my screenshot?
It’s the first question most people ask, and the honest answer is: sometimes, but a raw screenshot is a weak, easily challenged form of digital evidence. A screenshot is a picture of a screen. It carries none of the underlying metadata (who sent what, when, from which number or account), and it is easy to fake, so the other side can challenge it and a judge can give it little weight. What holds up is the original record, preserved intact, with a documented trail showing it has not changed. That is the difference between a screenshot and forensic evidence, and it is the whole reason this work exists. For a rule-by-rule walkthrough, see our digital evidence for court checklist.
Four rules for preserving evidence before you call anyone
Whether or not you ever hire an examiner, these four rules protect your evidence from the moment you realize you might need it. Getting them right early is often what decides whether the evidence survives a challenge later.
- Preserve the original, and never delete it. Deleting a message after you screenshot it can look like spoliation (destroying evidence) and can hurt your case more than the message ever helped it. Keep the source device and the source account intact.
- Capture the whole thread, not a crop. Full conversations, with phone numbers, account names, and timestamps visible, tell a complete story. A cropped fragment invites the argument that you left out the context.
- Preserve the metadata, not just the picture. Export or back up the original record rather than photographing the screen; the metadata (timestamps, sender identifiers, message IDs) is what lets the record be authenticated later.
- Obtain it lawfully. Evidence gathered by logging into someone else’s account or planting tracking software is often unusable, and it can expose you to criminal liability. Preserve what is yours and what you are lawfully allowed to access.
Chain of custody, in plain language
“Chain of custody” sounds like courtroom jargon, but it is a simple idea: a written record of where a piece of evidence came from, who has handled it, and proof that it has not changed along the way. In practice that means preserving the original, recording each step, and taking a cryptographic hash, a digital fingerprint, so anyone can verify the file is identical to the one first collected. That record is what turns raw material into something a court can rely on. If you want the full path, see how evidence becomes a court exhibit.
How the examination actually works
When a matter needs more than preservation, the work is methodical and documented at every step:
- we collect from the source device or account under a documented chain of custody
- hash the data on ingest
- analyze it with forensic tooling
- and write findings in plain language backed by the underlying evidence, in a report you or your attorney can act on
For a step-by-step picture of that process from first call to final report, see what a digital forensics investigation looks like.
Every case is reviewed by a credentialed examiner before findings leave the practice. If you are weighing whether to bring someone in, start with what hiring a digital forensic examiner involves, or how to organize evidence for a lawyer or the police. If a crime is involved, here is how to report digital evidence to law enforcement.
How an engagement begins
- Confidential consultation. NDA-protected. 30-60 minutes. Direct conversation, no sales process.
- Signed engagement. A fixed price set by the number of devices. You sign the agreement and the chain-of-custody form before any work starts.
- Examination and report. A written report with the hash values, the method, the tools and their versions, and the exhibits.
Why this work matters
Digital forensics services built for individuals, covering computer, phone, and cloud forensics on the same forensic methodology Fortune 50 enterprises and attorneys rely on. Quinn holds 9 active certifications across GIAC, a methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us.
Two ways to work a case
Hand it to an examiner, or run it yourself.
Both keep a chain of custody from the first file. The difference is who does the work.
Done for you
An examiner takes the case
A credentialed examiner works the case end to end and stands behind the report.
- Who it is for: anyone in a crisis, on a deadline, or who wants the case off their plate
- What you get: a credentialed examiner, the same forensic output and chain of custody
- Your effort: hand over the devices or accounts, and we do the work
- Price and billing: Fixed fee by number of devices. You see your exact price before you sign.
Self-serve
Run it yourself
Fully automated digital forensics you run yourself. SleuthX automates a digital investigation end to end, from collecting and analysing the evidence to a report with every finding cited.
- Who it is for: hands-on people who want to see what happened for themselves
- What you get: A SHA-256 hash of every file as it is added, re-checked against the stored copy; An append-only chain-of-custody log; Every finding cited to the evidence it came from; An examiner's review when you want one
- Your effort: you add the evidence and steer the investigation
- Price and billing: $200/mo, billed monthly and renews until you cancel. Includes $200 of usage credit each month. The credit resets at the start of each billing month and does not carry over. Usage beyond it draws down a prepaid balance you top up in-app, and top-ups never expire.
Automated output is prepared to evidentiary standards. Before you rely on it in court, a qualified examiner has to review it and be able to certify the work.
