Mobile Device Forensics | Secure Data Consortium

What this service does

Forensic examination of mobile devices in matters where the device owner has consented to examination — divorce and family-law cases, suspected intimate-partner surveillance, employer investigation of suspected data theft on company-issued devices, and similar civil contexts. The practice covers both Android and iOS devices that are unlocked or for which the passcode is known. The deliverable is a written report suitable for use in deposition or as documentary evidence.

Stalkerware and surveillance app detection. Examination for known stalkerware families, hidden monitoring apps, configuration anomalies suggesting covert access, and persistence mechanisms. Common in family-law and intimate-partner abuse cases.
Single-device forensic examination. Full examination of a single Android or iOS device including installed applications, account configuration, recent activity, message and call artifacts, location history where preserved, and indicators of unauthorized access. Written report with chain-of-custody documentation.
Multi-device and litigation-grade examinations. Larger-scope work for matters likely to result in litigation. Includes more rigorous chain-of-custody handling, write-blocker use for any SD-card extraction, and a report formatted for evidentiary use.
Expert testimony. Available for matters where examination findings need to be presented in deposition. Hourly with daily cap specified in the engagement letter.

Scope and limits

Setting expectations honestly is part of good forensic practice. What this service does and does not do:

Consent-based, unlocked or known-passcode devices. Examination requires either the device owner's documented consent or a relevant legal order, and the device must be unlocked or the passcode known. This covers the substantial majority of family-law and intimate-partner cases. Locked devices where the client does not have the passcode are referred to litigation-grade forensic firms.

Consent required. Examination requires either the device owner's documented consent or a relevant legal order (subpoena, court order). This practice does not undertake covert examination.

Civil matters. Practice focus is civil and family-law matters. Criminal-investigative work for law enforcement is outside scope and should be referred to certified law-enforcement examiners.

Deposition-grade documentation. Every report identifies the tooling used and its known limitations. No overclaim of capability. Every finding is reproducible from the documented methodology.

Pricing

Pricing is per engagement and discussed during scoping. Typical ranges:

Stalkerware triage: $750 — focused sweep for surveillance indicators on Android or iOS, written summary, approximately three hours of work, two-week turnaround.
Single-device forensic exam with written report: $1,500 – $2,500 — full examination, deposition-grade report, two-to-four-week turnaround.
Multi-device or litigation-grade examination: $3,000 and up — larger scope, more rigorous documentation, four-to-eight-week turnaround.
Expert testimony: $200/hour with daily cap defined in the engagement letter.

Who this serves

Family-law attorneys in Northeast Florida (Jacksonville, St. Augustine, Yulee, Fernandina Beach, Amelia Island) and remote engagements elsewhere.
Domestic violence advocacy organizations needing technical assessment of victim devices for indicators of partner surveillance.
Small employers investigating suspected data theft on company-issued mobile devices.
Estate and probate attorneys needing examination of devices belonging to deceased account-holders.

Credentials

CISSP CSSLP CRISC

Forensic examinations performed under the standards expected for civil-litigation documentation. The practitioner is a senior security architect and developer with 19+ years in security and information systems and credentials specifically in security architecture (CISSP), secure software lifecycle (CSSLP), and information systems risk management (CRISC).

Start a conversation