Forensic, Attribution & Evidence Integrity Briefings
Longform technical briefings authored from 25+ years of District Attorney’s Office digital forensics and cyber response experience.
Deleted Data Recovery: What is Actually Possible?
Clients often ask, "Can you get back my deleted Signal messages?" The answer is complex.
On modern iPhones (post-iOS 11) and Androids (post-v7), file-based encryption makes recovery from "unallocated space" nearly impossible once the file has been purged from the database. However, recovery is often possible through:
- Local backups (iTunes/iCloud/Google Cloud).
- Sync artifacts on linked devices (Macs/PCs).
- Database fragmentation (the "WAL" file in SQLite).
We help our clients understand the difference between "Deleted" and "Purged," and where the technical "Hail Marys" actually exist.
Digital Evidence & The Jury: Bridging the Clarity Gap
How to present complex forensic findings to a jury without losing them in technical jargon, ensuring the "facts of the case" remain the focus.
Cellebrite Deconstructed: Logical vs. Physical Extractions
A deep dive into why relying on a standard "Logical" report can lead to devastating omissions in criminal defense cases.
The Invisible Chain: Maintaining Forensic Soundness
Why "Chain of Custody" is more than just a piece of paper, and how technical missteps during collection can invalidate entire cases.
IP Address Geolocation: Fact vs. Forensic Fiction
Explaining why an IP address is rarely a "physical address" and how prosecution experts often overstate location accuracy.
Metadata: The Digital Fingerprint of User Intent
Analyzing the "Data about Data" to prove whether a file was intentionally created, moved, or automatically generated by the system.
Deleted Data Recovery: What is Actually Possible?
Setting realistic expectations for recovering "purged" communications from modern mobile and cloud-based systems.
The Art of the Rebuttal: Strategies for Cross-Examination
How to dismantle a prosecution expert’s technical testimony by identifying overstatements and methodological shortcuts.
Cross-Platform Artifact Correlation: The Unified Timeline
Using cloud, mobile, and wearable data to reconstruct a defensible unified timeline that contradicts isolated evidence claims.
Email Header Analysis: Reading the Route
How RFC-5322 routing hops, cryptographic authentication signals (SPF, DKIM, DMARC), and server timestamps separate genuine origin from spoofing.