By Quinn Varcoe, Founder & CEO, SleuthX
Forensics confirms. You keep the story.
Investigative reporting runs on a simple division of labor that protects its own credibility: the people who gather and verify technical evidence are not the people who decide what the story is.
A digital forensics practice belongs on the technical side of that line.
We establish, with documented methods, what a phone, a laptop, an account, or a public record actually contains — and we say plainly what that does and does not prove.
The judgment, the framing, and the decision to publish stay with you and your editors.
The clearest model is the Pegasus Project.
Amnesty International’s Security Lab performed the forensic analysis; the University of Toronto’s Citizen Lab independently peer-reviewed the methodology; and the reporting consortium owned the journalism.
The forensics did not steer the story — it gave the story a spine that could survive scrutiny.
That separation is not a limitation.
It is the reason the findings held.
- A direct line to Quinn, the founder — not a sales pipeline.
- Worked in-house by the examiner who scoped it.
- Explainable findings you can verify, with the methodology shown.
How an independent forensic practice supports reporting
We support newsroom work in four ways, each scoped in writing before it begins and each reviewed by a credentialed examiner before findings leave the practice:
- Digital security for journalists — threat-modeling, device and account hardening, and what forensic confirmation adds after a suspected breach.
- Protecting journalistic sources — secure intake, metadata minimization, and forensic methods that can help verify a channel without exposing a source.
- OSINT for journalists — lawful verification and provenance methods, the line research must not cross, and how forensics corroborates open-source findings.
- Newsroom device compromise response — what to do when a phone or device may have been targeted, and how a forensic spyware examination confirms or rules out an intrusion — the professional handoff the free guides stop short of.
Data stays on your machine — which is a form of autonomy
A recurring fear in sensitive reporting is that the very tools meant to help become a new exposure: a cloud platform that can be subpoenaed, a vendor that retains your material, an analytics pixel that quietly logs what you were researching.
Our default is the opposite.
Wherever the method allows, your reporting material stays on infrastructure you control, examined on hash-verified copies rather than uploaded wholesale to someone else’s server.
Evidence that lives on your machine cannot be silently produced by a third party who never told you.
We also tell you, before you commit, what we could and could not withhold if we were served with legal process.
Explainable, court-credible findings — not a black box
Credibility is the entire product.
A finding that cannot be explained cannot be defended — in print, in a correction, or on a witness stand.
Every examination is documented so the reasoning is visible: what was collected, how it was preserved, what method produced each conclusion, and where the uncertainty lies.
The work is prepared to support admissibility under the Federal Rules of Evidence 901 and 902, with a documented chain of custody and collection aligned to recognized standards (ISO/IEC 27037, NIST, SWGDE).
That court-grade discipline is the white space an advocacy guide cannot offer: a named, credentialed examiner who can stand behind the methodology.
And when a story moves into litigation — a defamation defense, a subpoena fight, or an outlet sued over what it published — that same documented record is what lets a credentialed examiner provide cybersecurity expert-witness support on the methodology and findings.
The language stays calibrated to what the evidence supports.
We write “consistent with”, “high-confidence”, and “no known indicators of compromise found” — never “proven” where the artifacts only show probability, and never “clean”, which forensics cannot establish.
Honest limits are what make the rest of the report trustworthy.
What working with us means
- Written scope before any work. You see a written scope — deliverables, timeline, and price — and approve it before we begin. You are never billed for work you did not authorize.
- We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts — we produce the record they act on, and we put that distinction in writing.
- Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation to court-admissible standards — not a single automated scan and a one-line answer.
- We will tell you if you do not need us. If a free or simpler step — a police report, an IC3 filing, a platform's own recovery flow — would resolve your situation, we point you there first.
Where to start
If you are not sure which guide fits, start with the situation.
Worried about a specific source or channel? Begin with source protection.
Suspect your own phone was targeted? Go straight to device compromise response.
Hardening a beat before anything goes wrong? Read digital security for journalists.
Verifying open-source material for a story? See OSINT for journalists.
Or talk to Quinn directly — the first conversation is confidential and there is no sales process.
