Evidence, reconstructed.
Oregon-based digital forensic services. Strict chain of custody on every item.
How a matter moves
-
Preserve
Chain of custody starts here
Each item is photographed as found, labeled, and logged with who handled it, when, and where. Every transfer is recorded, and the original is sealed so it stays unaltered.
-
Acquire
Devices are imaged through write-blockers. The copy is hashed with SHA-256 so it can be proven identical to the original.
-
Analyze
Artifacts, deleted material, timelines, and account activity are examined against the investigative question: what the data shows, and what it does not.
-
Report
A written narrative, the SHA-256 log, and the chain-of-custody record. Method is described so the work can be checked.
The original is never touched
Imaging happens through write-blockers. If a tool cannot prove it did not alter the source, I do not use it.
SHA-256
SHA-256 is the gold standard for integrity here. It is calculated at acquisition and again before analysis. A mismatch stops the work.
Written so it can be checked
The report describes what was done. I can testify to those methods. I do not offer an expert opinion.
A matter waiting is a record decaying.
Devices and backups do not wait for the next status conference. Intake is reviewed the same business day.