Basic Forensic Investigation for Litigation (Electronic Discovery): 1. You provide us legal access to the source media and describe or specify the target data being sought. 2. We protect the source media from alteration while we make forensically sound images (e.g. hard drive; exact copy using MD-5 & forensic hardware), after which the source media can be returned immediately.  3. We investigate the images(s) for the target data: stored as normal, hidden, deleted, embedded; inside NTFS compressed; inside proprietary internal file storage formats such as Outlook, AOL email, Outlook Express, Netscape email; inside common archive types such as '.ZIP', '.RAR' and many others. We can also investigate in some damaged/partial file types (e.g. fragmented, slack, unallocated ...) 4. If needed, we can investigate the many log files found in a hard drive image for 'usage trail' such as: power on cycles, internet access time frame, file deletion efforts, MS Word revision order, CD or DVD burning sessions, ... 5. Recovered data is archived and returned on requested media (e.g. CD, DVD, HD; fee for large media) 6. You may receive a basic report identifying the location of the relevant target data on the media. • We use media protection technology designed to prevent your media from alteration. • Recovery time varies based on: media size, number and types of search targets requested, level of file destruction, search depth for hidden content (e.g. zip inside zip), etc. • We can sign many standard non-disclosure agreements. ____________________________________________________________________________ Hard Drive Forensic Investigaton Fee Schedule as of May 27, 2015 (Synopsis): $1995 Basic Forensic Investigation for Litigation (Electronic Discovery): You may receive a data location report in acceptable presentation format, returned content is on media of choice in duplicate, MD5 generated for evidence items, chain of custody records, procedural records, we retain an archive of our work for 6 months. • Recovered data may be returned in multiple formats ...       º In its native format (e.g. a ‘.QBW’ file may need the correct version of Quickbooks for accessing).       º In a presentation format of choice, if feasable.        º Hard copy, if feasable.        º via email, if feasable. $120 per hour for consultations, opinion reports, declarations, analysis, proofs (i.e. beyond Basic Forensic Investigation for Litigation) ____________________________________________________________________________   Hard Drive Audit for non-litigation use:  We use industry standard forensic write block hardware for all modern drives. (e.g. IDE [aka PATA], SATA, SCSI, USB) Source drive is imaged and returned immediatley. Audit is performed on image. An audit of computer usage by employee/spouse/dependent. No Chain of custody records, No MD-5 is performed, no work log is created or archived, no analysis is performed, no opinion is formed, no report is returned; therefore no viable testimony/deposition available. Target content is gathered and returned on CD's or DVD's, we retain an archive during return shipping. $495 Standard Audit (for non-litigation use): We search for: normal, hidden, (by attribute setting) deleted, embedded, in NTFS compressed, in common, non-damaged email program data files (i.e. Outlook.pst, AOL email, Netscape, Earthlink), in common archive types such as '.ZIP'. $295 Simple Audit (for non-litigation use): We search for: normal and hidden file types. $300 priority fee, per media. $195 Hard Drive Imaging, plus media costs (e.g. second image for you to preserve if the source belongs to a third party). Fees for us to retain archives beyond contracted time vary by storage media and length stored: Hard Drive $100/month DVD/CD $2.50/month Additional storage media costs upon request (apx. $1.00 per GB of the total media). Prices are for contemporary hard drives and may vary depending on the job description. Coast Two Data Recovery reserves the right to reject any submitted job that does not meet its quoted description. Expert Consultation, Testimony, Deposition: Expert Consultation: onsite (local) or phone $120.00 per hour ($480 retainer, onsite 1 hour minimum). Expert Testimony / Deposition: $120 per hour, 4 hour minimum in Eugene, Oregon plus expenses ($1000 retainer). Expert Testimony / Deposition: $120 per hour, 8 hour minimum per day outside Eugene and within Western Oregon, plus expenses ($2000 retainer). Expert Testimony / Deposition: $120 per hour, 8 hour minimum per day outside Oregon plus expenses ($3500 retainer). Expenses may include: Travel, lodging, meals, rentals, phone, FAX, computer time, equipment, postage, courier services. Travel expenses may include air fare, vehicle mileage at $0.39 per mile (US), taxi, parking. Call for an estimate or quote based on your job description. All fees/retainers must be paid in advance before any departure or service is rendered. Refunds (minus costs incurred) for postponement/cancellation will vary depending on timing and scope.  for any postponement/cancellation after departure there is no refund, for any postponement/cancellation before departure there is a partial refund (contracted). The above fees also apply (i.e. are not increased) for 'Expert Witness' declarations. To avoid any misperception, we cannot charge for certain services on a contingency basis nor be paid after the fact. We understand the need for depositions to be paid by the requesting party and can contract with said under the same terms.   Optional Services: Archive imaging (including Encase format) Hard drive duplication Destination hard drive @ $1.00 per GB - $100 minimum Archive storage Phone consultation MD5 hash calculations for evidence objects (files and drives) Excess ‘keyword’ requests. Subsequent searches based on new criteria Chain of custody report Attempt "Password Breaking" for encrypted and password protected files (limited). Search inside encrypted files if the password is available. Non-disclosure agreements (that require legal review). Secure storage of secondary archives Priority/Expedite - per media Stitching or repairing of remaining pieces of partial files (intentionally/otherwise destroyed). File candidates are Outlook.pst, JPGs, WordPerfect. Rebuild and search of un-allocated compressed space Various report formats: HTML, .PPT, text with files, MS-Word, hard copy, others upon request. ___________________________________________________________________________________________ Gathering & Submitting Evidence: You must have a legal right to any media submitted for recovery. We must know of any restrictions (e.g. 3rd party demands destruction by a certain date.) You should identify your needs and specify the level of recovery needed. Be sure that you have gathered all available media during your first opportunity. Other media that may contain evidence includes: additional hard drives inside the suspect machine but disabled & un-noticed during system use, external hard drives, DVD-R & RW (various formats), CD-R, CD-RW, floppies, ZIP, Memory cards, miniature USB drives (about the size of a lipstick, easily fits in pockets, found in drawers and glove boxes). Confidentiality: We protect your confidentiality as allowed by law, however, there is no 'consultant/client' privilege, our records may be subpoenaed by parties that know of our involvement. A 3rd party 'blind' is possible.