Providing Digital Forensic and Expert Witness Services since 1998

FREQUENTLY ASKED QUESTIONS

Your competitors don't give details of their expertise or their rates on their websites, why does RTSI?

We've been in the digital forensics business longer than most other companies in the United States; we believe in being upfront about everything. We know that your time is valuable and don't want to waste it. Putting the information on the website allows you to decide upfront, without having to call or email for information, whether we are what you are looking for.

While anyone can buy computer forensic software and take a class to learn the basics of using it, becoming a proficient examiner, much less an expert, requires many years of experience.

Why are "Company XYZ's" rates so much cheaper than yours?

Most competent computer forensic examiners charge between $200 and $400 per hour. Companies that are charging significantly less typically do so because they lack the experience to be able to charge the standard rates. As with many things in life, quality costs more.

Frequently, these examiners have purchased a single piece of forensic software and possibly taken a class to learn its basic use. True forensic examiners will have a vast number of forensic tools available and will have been to many training classes.

Why should we choose you to examine our computer?

We have decades of experience in the recovery of computer data, computer forensics, and computer related investigations. Our clients include corporations of all sizes, as well as state and federal agencies.

We regularly provide expert testimony in state and federal courts concerning computer forensic examinations. We provide training to law enforcement officers (city, county, state, federal, and military) around the country in the investigation computer crimes and computer forensics.

We are the ones that other forensic examiners turn to for assistance. If it is important enough to use computer forensics, it is critical to use the best.

You're in Florida, wouldn't it be cheaper to get someone who is local?

We have clients throughout North America and Europe. Most of our cases never require any travel; the client ships the hard drive(s) to us. In civil cases, we frequently find evidence that causes the other side to seek settlement.

The most important factor in selecting a computer forensic examiner shouldn't be geography. There are a very limited number of truly qualified firms across the United States in the computer forensics field. Many of the major cities in the U.S. don't have any qualified individuals in the private sector.

Hiring the best qualified examiner may cost more initially, but is there any value in an incomplete examination? Only the best examiners can provide thorough examination and interpretation.

We have computer personnel in our company, why shouldn't we let them conduct the examination?

Although they may have a considerable amount of knowledge and experience with computers, perhaps even data recovery, it is highly unlikely that they have the requisite knowledge of the forensic protocols that must be observed to find all of the evidence, protect the data, and ensure the admissibility of evidence in civil or criminal trials. We take steps to safeguard the computer data; these steps require specialized training, hardware, and software. We have the training, experience, and tools to conduct a thorough examination of computer data and are able to interpret what we find.

In addition to the lack of skills, hardware, and software, using a company employee can open you up to allegations of fabricating evidence and other impropriety. We are an independent firm and integrity is the keystone of our company.

Can your employee qualify in court as an expert in the forensic examination of a computer? Probably not. Assuming their findings were not suppressed, they would only be allowed to testify to facts. They would not be allowed to testify to opinions or conclusions. Our expertise has already been recognized by state and federal courts around the country.

We often receive computers to examine after a company's computer personnel have attempted to recover evidence from it. In their attempts they have destroyed important evidence such as the date that files were last accessed. The forensic processes and hardware that we utilize are designed to safeguard every bit of evidence.

We don't plan on going to court. We're just looking for what an employee has been utilizing a computer for. Isn't it ok to use in-house computer personnel to do this?

If your concerns are strong enough to warrant the examination of a computer, then it is important to do it right. If the employee is fired or disciplined as a result of the examination, civil litigation will likely follow. We can provide you with the documentation and expert testimony that are necessary to substantiate your actions. Our vast experience allows us to not only find the evidence, but to interpret its meaning.

We are working with a Private Investigative company. Why can't they examine computers for us?

While there are many tens of thousands of Private Investigators around the country, the examination of computers is far beyond the skills and training of all but an extreme few. There are many specialties in Private Investigation; just because an investigator has excellent credentials for conducting financial investigations does not mean that they are qualified to examine computers. If you are going to pay someone to recover computer evidence, pay a professional examiner. With our expertise and tools, we can recover evidence that others wouldn't even know to look for.

Can we use a data recovery firm for doing computer forensics?

Some data recovery firms may have qualified forensic examiners; most probably do not. While some of the same skills and software are used in both computer forensics and data recovery, computer forensics requires extensive additional knowledge and experience. Remember, a forensic examiner is not only finding the data, but is also providing expert analysis of what they find. This expert opinion must be capable of standing up under intensive cross-examination. Likewise, you need to know the qualifications of the person(s) that will actually perform the examination rather than the collective qualifications of all of the examiners at the company. When it comes time for testimony, the individual examiner's qualifications, not the company's, will be under scrutiny.

We already have a relationship with a major accounting firm that says they can do computer forensics. Why can't they examine computers for us?

There are some excellent forensic examiners working for the major accounting firms. There are also some unqualified individuals being passed off as qualified. As with a data recovery firm or any other firm, the qualifications of every individual that will be involved in your case must be known in advance. Also be wary of a typical billing scheme that involves having multiple people "review" findings so that they can add the billable hours.

What qualifications should we look for in a computer forensic examiner?

There is an ever increasing number of people hanging out their shingle as computer forensic examiners. Some are among the most qualified individuals in the country; others are opportunists, lacking expertise, who believe they can make fast money. Some factors to consider include:

What does it cost?

We charge $300/hour for forensic analysis and require a $5000 retainer for ordinary cases (a single PC or Mac with an 80 gigabyte hard drive). An average examination generally takes a minimum of 30 hours, though this can vary greatly for any given situation. Factors that effect the amount of time required include: the amount of data to search (i.e.: hard drive size, number of CD's, etc.); volume of material; encryption; data hiding; and attempts as destroying the data. Call us for more details; there is no charge for the initial consultation. Our Rates, Terms, and Standard Agreement are available by clicking on the link below the next FAQ.

Why do you require a $5,000 nonrefundable retainer?

We are often asked to perform less than a complete analysis or to limit our hours in an effort to minimize the cost. We cannot honor these requests because we will not conduct less than a thorough analysis. Doing so shortchanges the client: all of the evidence sought is not found because insufficient time is allocated to the examination. It also places our reputation in jeopardy: if we do not find evidence that is present, it reflects poorly on us, even though our client asked us to limit our hours.

In our experience, the thorough examination of a computer is going to take at least 20 hours. If the potential client is not willing or able to invest this minimum amount, we are probably not the correct firm for them.


(352) 357-0500  Eustis, Florida, 32736 (Orlando Area)
rtsi@electronicdiscovery.com
FL PIA License# A-9800119
Copyright © 1998-2017 Rehman Technology Services, Inc.