Examiner-led collection, documented for when it is challenged
Counsel usually calls when opposing counsel has challenged how the data was collected, when an ESI deadline is close, or when a custodian’s phone holds messages the review platform never ingested.
In the EDRM model, collection comes before processing, review and production. We do identification, preservation and collection, then hand the collected data to the review platform you already use. We do not process, host or review documents.
E-discovery pairs with digital forensics and litigation support for attorneys when collection turns into investigation, and with the cybersecurity expert witness practice when findings need testimony.
Some service tracks are offered at a fixed fee; complex investigations are billed hourly with a clear scope, milestone updates, and a cap agreed up front.
Quinn examines the evidence and signs the report.
- A direct line to Quinn, the founder, not a sales pipeline.
- Worked in-house by the examiner who scoped it.
- Explainable findings you can verify, with the methodology shown.
What this means for you
- Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
Forensic ESI collection, source by source
The review-platform market owns the right side of the EDRM.
The left side of that model, getting the data out of devices and accounts with a documented method, is examiner work, and it is what we do.
What a defensible collection looks like per source:
- Devices (laptops, desktops, external media). Write-blocked imaging with two-hash verification, an acquisition hash at imaging and a verification hash on the working copy, so the production record shows the data analyzed is the data collected.
- Mobile. The messages that decide family-law, employment, and trade-secret matters rarely live in the mailbox. Forensic mobile extraction preserves the message databases with their metadata. See collecting text messages for e-discovery and the dedicated text-message evidence service.
- Cloud and SaaS (Microsoft 365, Google Workspace). Export paths that preserve message and file metadata, documented so the collection method itself is producible.
- Slack, Teams, and ephemeral messaging. Retention settings, export-tier differences, and disappearing-message features make this the easiest place to lose ESI without anyone deleting anything. We collect what the workspace tier actually retains and document what it never did. For background: Slack, Teams, and ephemeral messaging in discovery.
- Remote collection. Most custodian collections run remotely with the custodian’s cooperation and counsel’s authorization, through supervised exports for accounts, with chain of custody documented end to end.
Legal holds, preservation, and FRCP 37(e)
Collection defensibility starts before collection: identification and a hold that actually reaches the data.
We support counsel on the technical half of legal holds, covering which sources exist, what their retention behavior is, and what a custodian’s phone will and will not preserve on its own, and on preservation letters that name real artifacts instead of boilerplate.
As general information: FRCP 26(f) is where ESI protocol and format get negotiated; FRCP 34 governs the production forms; and FRCP 37(e) frames what a court can do when ESI that should have been preserved is lost and cannot be restored.
When the question becomes whether the other side already failed that duty, that is a spoliation forensic analysis engagement.
Small-firm primer: the small-firm ESI guide.
If the collection is challenged
In federal court, Rule 702 of the Federal Rules of Evidence requires the party offering an expert to show, more likely than not, that the expert is qualified, that the opinion will help the court or jury, and that it rests on sufficient facts or data and reliably applies reliable methods. The court decides. Our report sets out the facts and data, the method, the tools and their versions, and how the method was applied, which is the record counsel uses to make that showing.
FRCP 26(a)(2)(B) requires a testifying expert's written report to state the opinions and their basis, the facts or data considered, the exhibits, the expert's qualifications and publications from the previous 10 years, the cases with trial or deposition testimony in the previous 4 years, and the compensation.
How an engagement begins
- Free 30-minute consultation. NDA-protected. Direct conversation, no sales process.
- Scoped engagement. Written proposal with defined deliverables and pricing, a fixed fee where it applies and hourly with milestone caps for open-ended investigations.
- Examination and report. A written report with the hash values, the method, the tools and their versions, and the exhibits.
We examine only a device you own. Before we start, you sign a form stating that you own it. Other legal authority, such as a court order, is covered in our terms.
Why this work matters
In e-discovery the fight is often about how the data was collected, not just what it says, so the collection has to be defensible from the first byte.
Quinn holds 9 active certifications across GIAC, a methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us.
