Forensic Investigation for Litigation (Electronic
1. You provide us legal
access to the source media and describe or specify
the target data being sought.
2. We protect the source
media from alteration while we make forensically
sound images (e.g. hard drive; exact copy using MD-5
& forensic hardware), after which the source media can be
We investigate the images(s) for the target
stored as normal,
embedded; inside NTFS
compressed; inside proprietary internal file
storage formats such as
Outlook, AOL email,
Outlook Express, Netscape
email; inside common archive types
such as '.ZIP',
'.RAR' and many others. We
can also investigate in some
damaged/partial file types
(e.g. fragmented, slack, unallocated
4. If needed, we can
investigate the many log files
found in a hard drive image for 'usage
trail' such as: power on cycles,
internet access time frame,
file deletion efforts, MS Word revision
order, CD or DVD burning
5. Recovered data is archived
and returned on requested media (e.g. CD, DVD, HD; fee for
6. You may receive a basic
report identifying the location of the relevant target data on
• We use media protection technology
designed to prevent your media from alteration.
• Recovery time varies based on: media size,
number and types of search targets requested, level of file
destruction, search depth for hidden content (e.g. zip
inside zip), etc.
• We can sign many standard non-disclosure
Forensic Investigaton Fee
Schedule as of May 27, 2015 (Synopsis):
$1995 Basic Forensic Investigation for
You may receive a data location report in acceptable presentation format, returned
content is on media of choice in duplicate, MD5
generated for evidence items, chain of custody records,
procedural records, we retain an archive of our work
for 6 months.
• Recovered data may be returned in multiple
º In its
native format (e.g. a ‘.QBW’ file may need the correct
version of Quickbooks for accessing).
º In a
presentation format of choice, if feasable.
Hard copy, if feasable.
via email, if feasable.
per hour for consultations, opinion reports, declarations, analysis, proofs
(i.e. beyond Basic Forensic Investigation for
Drive Audit for
We use industry standard forensic write block hardware for all modern drives.
(e.g. IDE [aka PATA], SATA, SCSI, USB)
Source drive is imaged and returned immediatley.
Audit is performed on image.
An audit of computer usage by
- No Chain of custody records,
- No MD-5 is performed,
- no work log is created or archived,
- no analysis is performed,
- no opinion is formed,
- no report is returned;
- therefore no viable
Target content is gathered and returned on CD's or
DVD's, we retain an archive during return
We search for:
- hidden, (by attribute setting)
- in NTFS compressed,
- in common, non-damaged email program data files
(i.e. Outlook.pst, AOL
- in common archive types such as
$295 Simple Audit
We search for: normal
and hidden file
$195 Hard Drive
Imaging, plus media costs (e.g. second image for you to
preserve if the source belongs to a third party).
Fees for us to retain archives beyond contracted time vary
by storage media and length stored:
- Hard Drive $100/month
- DVD/CD $2.50/month
- Additional storage media costs upon request (apx. $1.00 per GB
of the total media).
Prices are for contemporary hard drives and may vary
depending on the job description. Coast Two Data Recovery reserves
the right to reject any submitted job that does not meet its quoted
Expert Consultation, Testimony,
Expert Consultation: onsite (local) or phone $120.00 per
hour ($480 retainer, onsite 1 hour minimum).
Expert Testimony / Deposition: $120 per hour, 4 hour
minimum in Eugene, Oregon plus expenses ($1000 retainer).
Expert Testimony / Deposition: $120 per hour, 8 hour
minimum per day outside Eugene and within Western Oregon, plus
expenses ($2000 retainer).
Expert Testimony / Deposition: $120 per hour, 8 hour
minimum per day outside Oregon plus expenses ($3500 retainer).
Expenses may include:
Travel, lodging, meals, rentals, phone, FAX, computer time,
equipment, postage, courier services.
Travel expenses may include air fare, vehicle mileage at $0.39
per mile (US), taxi, parking.
Call for an estimate or quote based on your job
All fees/retainers must be paid in advance before any departure
or service is rendered.
Refunds (minus costs incurred) for
postponement/cancellation will vary depending on timing and
- for any postponement/cancellation after departure there is no
- for any postponement/cancellation before departure there
is a partial refund (contracted).
The above fees also apply (i.e. are not increased) for 'Expert
To avoid any misperception, we cannot charge for certain services
on a contingency basis nor be paid after the fact.
We understand the need for depositions to be paid by the
requesting party and can contract with said under the same
- Archive imaging (including Encase format)
- Hard drive duplication
- Destination hard drive @ $1.00 per GB - $100 minimum
- Archive storage
- Phone consultation
- MD5 hash calculations for evidence objects (files and drives)
- Excess ‘keyword’ requests.
- Subsequent searches based on new criteria
- Chain of custody report
- Attempt "Password Breaking" for encrypted and password
protected files (limited).
- Search inside encrypted files if the password is available.
- Non-disclosure agreements (that require legal review).
- Secure storage of secondary archives
- Priority/Expedite - per media
- Stitching or repairing of remaining pieces of partial files
(intentionally/otherwise destroyed). File candidates are
Outlook.pst, JPGs, WordPerfect.
- Rebuild and search of un-allocated compressed space
- Various report formats: HTML, .PPT, text with files, MS-Word,
hard copy, others upon request.
Gathering & Submitting
You must have a legal right to any media submitted for recovery.
We must know of any restrictions (e.g. 3rd party demands
destruction by a certain date.) You should identify your needs and
specify the level of recovery needed. Be sure that you have gathered
all available media during your first opportunity. Other media that
may contain evidence includes: additional hard drives inside the
suspect machine but disabled & un-noticed during system use,
external hard drives, DVD-R & RW (various formats), CD-R, CD-RW,
floppies, ZIP, Memory cards, miniature USB drives (about the size of
a lipstick, easily fits in pockets, found in drawers and glove
Confidentiality: We protect
your confidentiality as allowed by law, however, there is no
'consultant/client' privilege, our records may be subpoenaed by
parties that know of our involvement. A 3rd party 'blind'