Oregon

Evidence, reconstructed.

Oregon-based digital forensic services. Strict chain of custody on every item.

Capabilities

What is Examined?

Computer & storage forensics
Write-blocked imaging of workstations, servers, and media. Copies are verified with SHA-256 and include slack, unallocated, and hidden partitions.
Mobile device extraction
iOS and Android collections covering messages, location history, app artifacts, and deleted records where the device and legal authority allow.
Hard drive & SSD duplication
A verified copy of a hard drive or solid-state drive for a private individual, made without writing to the original.
Written findings
A written account of what was collected, how it was collected, and what was found. I can testify to the methods I used.
30-minute consultation
A half-hour call to say what you have, what question you need answered, and whether this practice is the right fit.

Method

01
Preserve
Photograph the item, record who has it, and stop any handling that would break the chain before the copy is made.
02
Acquire
Write-blocked collection. SHA-256 at capture, and again before analysis. Every handoff is named, dated, and signed. The chain starts here, not in the report.
03
Analyze
Artifacts, deleted material, timelines, and account activity are examined against the investigative question: what the data shows, and what it does not.
04
Report
A written narrative, the SHA-256 log, and the chain-of-custody record. Method is described so the work can be checked.

Imaging happens through write-blockers. If a tool cannot prove it did not alter the source, I do not use it.

SHA-256 is the gold standard for integrity here. It is calculated at acquisition and again before analysis. A mismatch stops the work.

The report describes what was done. I can testify to those methods. I do not offer an expert opinion.

A matter waiting is a record decaying.

Devices and backups do not wait for the next status conference. Intake is reviewed the same business day.