We offer free consultations to ensure we develop the best approach to secure all available information that will be needed during an investigation.

When in doubt, reach out

The more time that goes by, the less likely an examiner will be able to recover certain types of data. Keep in mind that phones, accounts, and computers, can all be wiped at the push of a button, a click of a mouse, and even remotely.

Tools and techniques perfected through years of experience

Gateway Forensics uses advanced analytical and investigative techniques to secure, identify, retrieve, preserve, and present evidence that is stored on most digital devices. Our years of experience coupled with progressive technology allows us to complete forensic analysis on computers, tablets, cellular devices, GPS devices, cloud architecture, smartphones, and even drones. Our staff is trained to handle your devices and accounts with care as well as to preserve the forensic evidence stored within them. We perform extensive analysis to ensure that you obtain the evidence and information needed, keeping you informed throughout the entire process.

At Gateway Forensics, our team has the necessary experience and knowledge to deliver the results you need, with the professionalism you deserve.

Our Process

Our Process


This phase begins when you contact our team of examiners for the first time regarding a potential digital forensic investigation and can be started with any form of communication. Get started today!


The consultation phase begins as soon as our team of experts respond to the initial inquiry. During this phase, we will ask necessary questions in order to identify if, and how, digital forensic artifacts and data sources may best be obtained to ensure we preserve the most holistic collection of data for your investigation.

Please be prepared to answer the “who”, “what”, “when”, “where”, “why”, and “how” regarding the investigation.


This phase is performed after our examiner has an understanding of the investigation and has determined the scope of the engagement. The identification of any and every source of evidence is a crucial step for the investigation and will be based on what our examiners were able to glean from the consultation phase.

Data sources can include items such as: cloud accounts, backups, watches, phones, computers, IoT devices, storage devices, vehicles, & more.


The collection phase begins when our team of experts take control of the evidence source from the custodian. During this phase, a chain of custody will be established for accountability purposes and to maintain the integrity of the evidence collection throughout the entire process. The chain of custody ensures that we: mitigate risk, ensure quality, maintain accountability, integrity, and admissibility.


The preservation of evidence takes place during this phase of the engagement process. This can be completed in a multitude of ways, including the use of write-blockers for forensically sound acquisitions of computer and other like devices, the use of forensic software for mobile device captures, backups, etc. Every step of this process must be done in a controlled and maintained environment to ensure the best possible capture is completed.

Our team of examiners will then create a secondary, “working” copy of the data to maintain the integrity of the original data source. The original capture is then stored with an evidence file in a double locked safe, inside of our forensic laboratory for no less than 7 years from the date of collection.


During the analysis phase of the engagement process, our team of examiners will investigate the “working” copy of the collected data sources to answer the questions that prompted the investigation. Keep in mind that this phase may lead to the discovery of additional data sets which also may need to be acquired.

Please be available to answer any questions that our team of examiners may have during their investigation. These questions may be as simple as asking for additional passwords or information to gain more relevant artifacts for your case.


Upon the completion of the analysis phase, our examiners will produce a report that can, and likely will be, used in a court of law regarding the findings of our investigation. The format of this report will be dictated by you and your preference.

Additionally, part of the production phase could also consist of our team of experts performing an oral report. This can be completed either through an in-person meeting, a phone call with the end client, expert testimony, or through a deposition.


The presentation phase is the final phase of the engagement process and is completed once our examiners have provided an “out-brief” and all deliverables to you. This can be done with or without presentation media and may often not even take place. This optional “out-brief” is dependent again on your preference.

Furthermore, expert testimony may also be performed in this phase regarding our investigation, this is a great way for our experienced team of examiners to relay our highly-technical findings into simple and easy to understand information.

Our Promise

Our Promise

Gateway Forensics pledges to remain available to you throughout the entire engagement process and even after completion to answer any questions that may arise or to produce additional documentation as needed.


Read more about our Principal and the certifications that make us uniquely qualified to aid in your investigation.

Our Services

From Incident Response to Mobile Forensics, Gateway Forensics is the best option for digital investigations.

Areas Served

Based in Maryland, Gateway Forensics provides services across the U.S., including Alaska and Hawaii.

Our Partners