Forensic services for law firms, from collection to testimony

Digital evidence documented for review, and an examiner who signs the report

When a matter turns on what is on a device, in an account, or in a data set, your firm needs two things: evidence collected and documented with the method shown, and an examiner who can take the stand and explain it.

This page lists every forensic service we offer law firms.

The spoke pages below route you to the specific engagement your case needs, and the literal head term,digital forensics for attorneys, lives on its own page.

Some service tracks are offered at a fixed fee; complex investigations are billed hourly with a clear scope, milestone updates, and a cap agreed up front.

Quinn examines the evidence and signs the report.

• A direct line to Quinn, the founder, not a sales pipeline.
• Worked in-house by the examiner who scoped it.
• Explainable findings you can verify, with the methodology shown.

Route your matter

• Digital forensics for attorneys covers the litigation-support core: acquisition, analysis, FRE 901/902 foundations, reporting.
• Text message evidence for court covers producing, certifying (FRE 902(14)), and defending text threads; fabricated-message examination.
• Spoliation forensic analysis covers deletion-timing and wiping-artifact analysis, emergency preservation, FRCP 37(e) technical support.
• E-discovery services for law firms covers defensible forensic ESI collection and legal-hold support.
• Cybersecurity expert witness covers Rule 702 reports, testimony, and rebuttal review of opposing experts.
• Digital forensics for divorce and forensic phone extraction covers the family-law track.
• Insider threat and fraud investigation covers employee misconduct, trade-secret theft, event reconstruction.

Field work runs through our licensed private investigator referral network, including the surveillance investigation referral and the insurance fraud investigation referral for SIU and claims counsel.

SleuthX is a digital forensics firm. We are not a licensed private investigation agency, and our examiners are not licensed private investigators. The forensic examination, e-discovery, and expert work on this page is SleuthX’s own practice.

What this means for you

• Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
• We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
• Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
• We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.

Engagement and pricing, stated plainly

Forensic work for counsel starts with an engagement retainer, and you decide how its hours are spent. Its terms are in the engagement letter.

Deposition and trial testimony are engaged separately and priced in writing before the work starts.

Well-bounded engagements (single-device extraction, a defined preservation) can be fixed-fee.

Scope, deliverables, and a budget cap go in writing before work begins.

The engagement letter names your firm as the directing client. Drafts, and most communications between you and a testifying expert, are protected under FRCP 26(b)(4)(B) and (C). Communications about compensation, and facts or assumptions you provide that the expert considers or relies on, are not.

The examiner behind the work

Quinn Varcoe is the examiner who signs the report. Testimony is arranged per matter, after we confirm it can be given in your court. The Rule 26(a)(2)(B) disclosures are prepared with the written report.

In federal court, Rule 702 of the Federal Rules of Evidence requires the party offering an expert to show, more likely than not, that the expert is qualified, that the opinion will help the court or jury, and that it rests on sufficient facts or data and reliably applies reliable methods. The court decides. Our report sets out the facts and data, the method, the tools and their versions, and how the method was applied, which is the record counsel uses to make that showing.

FRCP 26(a)(2)(B) requires a testifying expert's written report to state the opinions and their basis, the facts or data considered, the exhibits, the expert's qualifications and publications from the previous 10 years, the cases with trial or deposition testimony in the previous 4 years, and the compensation.

The methodology is aligned to NIST SP 800-86 and SWGDE practice, backed by 9 active certifications across GIAC, each verifiable with the issuing body.

Where a matter requires Cellebrite, Magnet AXIOM, or a similar extraction platform, those platforms are engaged through our partner network.

One examiner, one methodology, no junior intermediaries between your trial team and the person who did the work.

The litigation library

The depth behind these service pages is published and free, written for counsel and organized by matter type:

Family law and custody

• Screenshots aren’t enough: why family-law texts need a forensic extraction
• How to authenticate text messages in court (FRE 901 & 902)
• The hearsay trap: when text-message evidence gets thrown out
• What digital evidence actually proves in a custody fight
• Finding hidden assets in divorce
• Deleted photos and location data in a family-law case
• Spoliation in family law: sanctions when the other side deletes evidence
• A litigation-hold template that covers a phone
• iCloud & Google backups: what counsel can and can’t subpoena
• What a divorce forensic exam costs

Expert witness and admissibility

• How to vet and qualify a digital forensic expert (Daubert checklist)
• Challenging the other side’s forensic report
• What goes into a forensic report
• Chain of custody, explained for litigators
• Expert witness vs. collection vendor: which do you need?

E-discovery and ESI

• E-discovery vs. digital forensics: which do you need?
• Collecting text messages and mobile data for e-discovery, defensibly
• Slack, Teams, and ephemeral-messaging discovery
• The small-firm guide to ESI from phones and cloud apps

Criminal defense, location, and social evidence

• How to challenge a phone extraction in criminal defense
• Geofence and cell-tower location evidence, explained
• Authenticating social-media evidence for trial

How an engagement begins

1. Free 30-minute consultation. NDA-protected. Direct conversation, no sales process.
2. Scoped engagement. Written proposal with defined deliverables and pricing, a fixed fee where it applies and hourly with milestone caps for open-ended investigations.
3. Examination and report. A written report with the hash values, the method, the tools and their versions, and the exhibits.

We examine only a device you own. Before we start, you sign a form stating that you own it. Other legal authority, such as a court order, is covered in our terms.

Why this work matters

Every engagement is built to be defensible, with a documented chain of custody and FRE 901-ready methodology.

Quinn holds 9 active certifications across GIAC, a methodology trusted by Fortune 50 enterprises, defense contractors, and the attorneys who refer to us.