This phase begins when you contact our team of examiners for the first time regarding a potential digital forensic investigation and can be started with any form of communication. Get started today!

The consultation phase begins as soon as our team of experts respond to the initial inquiry. During this phase, we will ask necessary questions in order to identify if, and how, digital forensic artifacts and data sources may best be obtained to ensure we preserve the most holistic collection of data for your investigation.

Please be prepared to answer the “who”, “what”, “when”, “where”, “why”, and “how” regarding the investigation.

This phase is performed after our examiner has an understanding of the investigation and has determined the scope of the engagement. The identification of any and every source of evidence is a crucial step for the investigation and will be based on what our examiners were able to glean from the consultation phase.

Data sources can include items such as: cloud accounts, backups, watches, phones, computers, IoT devices, storage devices, vehicles, & more.

The collection phase begins when our team of experts take control of the evidence source from the custodian. During this phase, a chain of custody will be established for accountability purposes and to maintain the integrity of the evidence collection throughout the entire process. The chain of custody ensures that we: mitigate risk, ensure quality, maintain accountability, integrity, and admissibility.

The preservation of evidence takes place during this phase of the engagement process. This can be completed in a multitude of ways, including the use of write-blockers for forensically sound acquisitions of computer and other like devices, the use of forensic software for mobile device captures, backups, etc. Every step of this process must be done in a controlled and maintained environment to ensure the best possible capture is completed.

Our team of examiners will then create a secondary, “working” copy of the data to maintain the integrity of the original data source. The original capture is then stored with an evidence file in a double locked safe, inside of our forensic laboratory for no less than 7 years from the date of collection.

During the analysis phase of the engagement process, our team of examiners will investigate the “working” copy of the collected data sources to answer the questions that prompted the investigation. Keep in mind that this phase may lead to the discovery of additional data sets which also may need to be acquired.

Please be available to answer any questions that our team of examiners may have during their investigation. These questions may be as simple as asking for additional passwords or information to gain more relevant artifacts for your case.

Upon the completion of the analysis phase, our examiners will produce a report that can, and likely will be, used in a court of law regarding the findings of our investigation. The format of this report will be dictated by you and your preference.

Additionally, part of the production phase could also consist of our team of experts performing an oral report. This can be completed either through an in-person meeting, a phone call with the end client, expert testimony, or through a deposition.

The presentation phase is the final phase of the engagement process and is completed once our examiners have provided an “out-brief” and all deliverables to you. This can be done with or without presentation media and may often not even take place. This optional “out-brief” is dependent again on your preference.

Furthermore, expert testimony may also be performed in this phase regarding our investigation, this is a great way for our experienced team of examiners to relay our highly-technical findings into simple and easy to understand information.

Gateway Forensics pledges to remain available to you throughout the entire engagement process and even after completion to answer any questions that may arise or to produce additional documentation as needed.