Practical questions about a New York forensic engagement
Start with your question, the people and organizations involved, device locations and the deadline. We help identify the evidence sources and the collection arrangements, then explain the agreed deliverables and cost.
Remote email collection lets clients keep working in their accounts. A client's phone can also be collected through a supported remote workflow while the client retains the device. The collection plan is coordinated with the authorized user and the needs of the case.
For an employee departure, ask about flat-rate Core Analysis for an agreed scope. For discovery, specify the sources, date ranges, search requirements and delivery format. For expert testimony, bring the disputed technical question and relevant reports.
- Employee departure review
- Client phone collection
- Discovery coordination
- GDF's broader forensic service FAQ
What should I prepare before calling about a New York matter?
Have the question, relevant organizations, device and account locations, authorized contacts and deadline ready. GDF will help define the collection and analysis plan and explain the cost and deliverables.
Early decisions have an outsized effect on cost and evidence quality. These answers describe GDF's technical process. They are not legal advice, and the right method depends on the source and matter.
Should a device be turned off?
It depends. Life safety, personal safety, and urgent operational containment take priority. When no immediate protective action is required, a powered-on encrypted device may lose accessible keys if shut down, a connected phone may receive remote changes, and a damaged drive may deteriorate with use. Avoid exploratory handling, record what is currently visible and who has handled the source, and obtain source-specific technical guidance before changing state.
Can deleted data always be recovered?
No. Recovery depends on the device, storage technology, encryption, overwrite, application behavior, cloud retention, backups, and time. Modern solid-state storage and mobile systems may remove deleted content quickly. A recovery assessment should identify alternative sources instead of promising a result.
Can work be done remotely?
Many cloud, email, and supported device collections can be handled remotely. Physical damage, some full-device acquisitions, specialized hardware, contested handling, or short-lived live data may require on-site or laboratory work. The collection method and its limits are documented either way.
What drives time and cost?
Source count, data volume, encryption, access, damage, date range, custodian count, cloud provider, tool support, urgency, search protocol, reporting depth, opposing-expert work, and testimony all matter. A focused question and early source map usually control cost better than a broad request to examine everything.
What does counsel receive?
Deliverables may include an acquisition record, evidence inventory, chronology, artifact table, findings memorandum, expert report, declaration support, demonstrative, or testimony. Scope determines the deliverable. Observed facts, inferences, and limits are kept distinct.