What to Expect From a Digital Forensic Examination

For Maine attorneys who have not retained a digital forensics examiner or expert before. About a ten-minute read.

What an examination is and is not

A forensic examination makes a verified copy of a device or account, then analyzes that copy to answer specific questions: what was on it, when, who accessed it, what was deleted, where it was. It is not a general search for anything bad. The narrower the question, the faster and cheaper the answer and the more defensible the result.

In Maine, the collection and examination of devices is investigative work and is performed by a licensed private investigator. Reading the results, explaining them, and testifying to what they mean is expert work. Digital Forensics Maine coordinates both and provides the expert.

The sequence

1. Scoping call with counsel. Device and account count, the questions to be answered, whether a protocol or stipulated order governs, and what deliverable is expected. Twenty minutes, no charge.
2. Engagement terms. A retainer against hourly examiner and expert rates, with the estimate in writing. Engagement runs through counsel, not through a party, so privilege and protective order terms are set from the start.
3. Preservation and collection. Devices are collected on site anywhere in Maine or shipped under chain of custody. Each is photographed, its state recorded, and a forensic image is created and hashed. Originals are sealed. This is the point of no return for evidence, and it usually happens within days of engagement.
4. Examination. Analysis of the working copy against the questions in scope. Typical turnaround on a two-device matter is one to two weeks after collection, longer for large data sets or cloud accounts that require preservation requests.
5. Report. Findings in plain language with the method, the artifacts relied on, and the limits of what the evidence shows. Written to be read by a judge.
6. Testimony. Deposition or trial, with a written opinion and CV provided in advance. $400 per hour, two-hour minimum.

What drives cost

• Number of devices and accounts. Each is imaged and examined separately.
• Scope. "Was this phone used to access her email between these dates" is a day. "Find everything" is a month and still will not answer a question.
• Cloud accounts. Preservation and production from Apple, Google and Microsoft take time and sometimes a subpoena.
• Large collections. Tens of thousands of photos or emails to be filtered for production require a defined method and a review phase.
• Protocol. A stipulated examination order adds process and sometimes a neutral examiner, which adds cost but removes disputes later.
• Testimony. Preparation time for a deposition is usually two to four hours beyond the appearance.

What a report contains

• The question asked and the devices examined.
• Chain of custody and hash values.
• Method and tools.
• Findings, each tied to specific artifacts with timestamps.
• What the evidence does not show, stated plainly.
• The examiner's and expert's qualifications.

Common mistakes that cost cases

• The client changed passwords or reset the phone before anyone was retained. See the preservation checklist.
• A party retained the examiner directly, without counsel, and the engagement became discoverable.
• The scope was "everything," the budget ran out, and the one question that mattered was never answered.
• The remediation, getting the other party out of the accounts, happened before imaging, and the trail was gone.

Out-of-state matters with a Maine party

Counsel in another state with a plaintiff, defendant or witness in Maine can have devices collected here, examined to the court's protocol, and reported to counsel wherever the case sits. The examiner travels anywhere in Maine. Shipment under chain of custody is an option when the court allows it.