Technical evidence,
made clear.

The challenge

Counsel was challenging a document signed electronically. They needed to know where the signature came from, when it happened, how it was made, and how the signer was verified.

Counsel also had text-message screenshots and a screen recording. Were the files genuine? Did anything in them connect to the signing?

Our approach

• Read-only from the start. Every file got a SHA-256 hash (a unique digital fingerprint) before and after. All 76 came back unchanged.
• Signing records. We compared the signing certificate and event history line by line, and rebuilt the signing timeline to the second.
• Screenshots and video. We ran OCR on every image, then checked on-screen clocks, battery levels, dates and screen sizes for consistency.
• A written method citing NIST SP 800-86, ISO/IEC 27037 and SWGDE, and addressing FRE 702 and 901.

What counsel got

• A plain-English signing timeline, every statement tied to the source files
• A clear line between what the records prove and what they don't
• A finding that the copies were re-printed, not native originals
• A source map tracing the screenshots to at least six devices, with edited or re-saved files flagged

The challenge

A family buying a home got an email that seemed to come from their title company, with new wiring instructions. This is business email compromise (BEC). The down payment went to an account at a second bank and was not recovered.

Counsel sued both banks, and one bank moved to dismiss. Counsel needed a fast, plain read of the motion, and a clear view of what the evidence could and could not prove.

What we did

• Pleadings review. Cut a 32-page complaint and the 180-page motion to a short brief that rated each argument by risk.
• Email comparison. The fake copied a real signature block, changed small details, and dropped the anti-fraud warning. Tracing who held the real signature narrowed where the compromise likely happened.
• Bank-record review. Found warning signs in the sending bank's own wire paperwork, and recorded what the file did not show.
• Gap analysis. Confirmed the file held no receiving-bank records, and wrote technical subpoena schedules.
• Public records. Showed the receiving account belonged to an anonymous shell company that dissolved after the fraud.

What counsel got

• Two plain-English attorney work-product reports
• An eight-part forensic work plan, ranked by priority
• Technical subpoena schedules and a list of who should get record-keeping letters
• Factual errors in the complaint, flagged for an amendment