Print this page (attorney exhibit format)
These records are commonly used to support internal review, insurance claims handling, and legal preservation obligations.
Engagement & Scope Definition Process
Preservation acquisition (including imaging where appropriate) is performed using documented, repeatable procedures with integrity verification. (See Preservation Principles.)
This page presents a high-level overview of how evidence-related work typically proceeds—from initial contact through documented handling—without reference to specific tools, guarantees, or outcomes.
Scope, fees, and authorization are established in writing before any handling begins. Verbal discussions are for clarification only and do not alter written terms. Evidence is not accepted for transfer until a method and access plan are confirmed.
What you receive
- Chain-of-Custody Record (PDF)
- Acquisition Log and Handling Notes
- Hash Verification Record (where applicable)
- Storage / Device Metadata Sheet (where applicable)
- Delivery Manifest and Verification Outputs
Documentation reflects technical evidence handling and preservation activities only.
Design Goals
- Clarity: define objectives and constraints before any technical engagement commences.
- Integrity: protect original materials and avoid unnecessary alteration.
- Repeatability: record steps so findings can be reviewed and explained.
- Conservatism: state assumptions and limitations plainly.
1. Intake & Screening
At-a-glance workflow
Engagement commences with written intake. The purpose of intake is to understand the question the evidence is intended to address, applicable deadlines, and any constraints affecting handling.
- Identify media types and general condition at a high level
- Flag potential risks (e.g., encryption, fragility, prior handling)
- Determine whether the request falls within the defined service scope
No preservation, collection, or analysis is performed prior to written scope acceptance.
2. Scope of Services
Before proceeding, scope is defined in writing so expectations are aligned.
- Objectives and deliverables
- Handling and transfer method
- Fees and timing
No engagement commences until scope and terms are reviewed and accepted in writing.
3. Defensible Evidence Handling
When materials are received, they are documented and handled in a manner appropriate to the engagement.
- Identification and labeling
- Separation of originals and working copies where feasible
- Verification steps appropriate to the task Evidence handoff details ↓
4. Scope-Limited Technical Review (if requested)
For cloud-hosted sources, data capture is performed using provider export or administrative tools (or approved APIs) under written authorization. Collected materials are logged and verified where feasible. Analysis is limited to the agreed scope and objectives.
Analysis is performed against the defined objectives, focusing on relevance and reliability rather than exhaustive exploration.
- Review of data artifacts relevant to the question
- Consistency and timeline checks
- Documentation of observations
Scope boundary: We focus on early-stage digital evidence preservation and acquisition.
When matters move beyond preservation into substantive analysis or expert interpretation, we may refer counsel to independent forensic firms based on scope and timing.
Conversely, when preservation or defensible acquisition is needed early in a matter, we are available to support downstream teams.
5. Reporting
Findings are summarized in clear, non-conclusory language, with methods and limitations described.
- What was examined
- What was observed
- What could not be determined, and why Evidence handoff details ↓
6. Findings Review & Verification Review
Questions and clarifications are addressed within the agreed scope. Any expansion of work is discussed and approved in writing.
- Clarifying questions from counsel or stakeholders
- Supplemental notes if needed
- Orderly close-out per agreed terms
Priority Preservation Pathway
Priority Scheduling (when available) is available for urgent or high‑stakes matters where rapid, controlled handling is critical.
- Expedited intake and engagement
- Accelerated documentation and chain‑of‑custody initiation
- Priority scheduling of preservation activities
- Secure handling workflows for time‑sensitive evidence
Priority access is confirmed in writing as part of scope and scheduling. Standard preservation pathways remain available for non‑urgent matters.
Evidence Handoff
Devices or storage media are transferred by appointment.
In-person handoff within the greater Boston area is available by scheduled meeting.
Shipped submissions are accepted when appropriate.
All transfers are documented in chain-of-custody records to preserve evidence integrity.
Important Notes
- This page is descriptive, not contractual.
- No representations or guarantees regarding outcomes or admissibility are made.
- Legal advice is not provided.
For boundaries and exclusions, see Scope & Limitations.
Why Email-First Intake Matters
In evidence-related matters, the manner in which an engagement begins can be as significant as the work that follows.
An email-first intake approach creates a contemporaneous written record of what was requested, when the request was made, and how the matter was initially described. This initial context may become relevant later, particularly if questions arise regarding scope, timing, or decision-making at the outset of an engagement.
Verbal conversations can be useful for clarification, but they are inherently transient. Details may be misunderstood, incomplete, or recalled differently over time. Written intake helps reduce ambiguity by documenting the requester’s description of the matter in their own words at the time the request is made.
Email-based intake also supports consistency. Information can be reviewed, confirmed, and referenced without reliance on memory or informal notes. This can be especially relevant in matters involving multiple stakeholders, evolving issues, or extended timelines.
From a professional perspective, email-first intake is not a procedural formality. It provides a documented starting point before any evidence-related work is performed and before scope or handling decisions are confirmed.
In some matters, courts or opposing parties may later examine what information was available at the beginning of an engagement and how subsequent actions were informed by that information. A contemporaneous written record can assist in demonstrating how the initial request and scope considerations were understood at that time.
For these reasons, many evidence professionals use email-first intake as part of a structured workflow. It supports clarity, accountability, and transparency without relying on post-hoc reconstruction.
This discussion is provided for informational purposes only. It does not describe investigative methods, provide legal advice, or establish a professional engagement.
Related guide
If you’re deciding whether you need early-stage preservation or later expert work, see: Evidence Preservation vs. Forensic Analysis.