Scope, Authority and Evidence Preservation
Start with your question, the people and organizations involved, device locations and the deadline. We help identify the evidence sources and the collection arrangements, then explain the agreed deliverables and cost.
Remote email collection lets clients keep working in their accounts. A client's phone can also be collected through a supported remote workflow while the client retains the device. The collection plan is coordinated with the authorized user and the needs of the case.
For an employee departure, ask about flat rate Core Analysis for an agreed scope. For discovery, specify the sources, date ranges, search requirements and delivery format. For expert testimony, bring the disputed technical question and relevant reports.
- Employee departure review
- Client phone collection
- Discovery coordination
- GDF's broader forensic service FAQ
What to Prepare Before Calling
Have the question, relevant organizations, device and account locations, authorized contacts and deadline ready. GDF will help define the collection and analysis plan and explain the cost and deliverables.
Ask About a Specific Source
Tell us the device or account and the question. A senior examiner will answer on a free call.
Early decisions have an outsized effect on cost and evidence quality. These answers describe GDF's technical process. The right method depends on the source and matter.
Turning a Device Off Can Destroy Evidence
It depends. Life safety, personal safety, and urgent operational containment take priority. When no immediate protective action is required, a powered on encrypted device may lose accessible keys if shut down, a connected phone may receive remote changes, and a damaged drive may deteriorate with use. Record what is currently visible and who has handled the source, and call for source specific technical guidance before changing its state.
Deleted Data Is Often Recoverable
Recovery depends on the device, storage technology, encryption, overwrite, application behavior, cloud retention, backups, and time. Modern solid state storage and mobile systems may remove deleted content quickly. A recovery assessment also identifies alternative sources such as backups and cloud copies.
Much of the Work Can Be Done Remotely
Many cloud, email, and supported device collections can be handled remotely. Physical damage, some full device acquisitions, specialized hardware, contested handling, or short lived live data may require on site or laboratory work. The collection method and its coverage are documented either way.
What Drives Time and Cost
Source count, data volume, encryption, access, damage, date range, custodian count, cloud provider, tool support, urgency, search protocol, reporting depth, opposing expert work, and testimony all matter. A focused question and early source map usually control cost better than a broad request to examine everything.
What You Receive
Deliverables may include an acquisition record, evidence inventory, chronology, artifact table, findings memorandum, expert report, declaration support, demonstrative, or testimony. Scope determines the deliverable. Observed facts, inferences, and limits are kept distinct.