What Drives the Cost
Four things: the number of devices and accounts, the volume of data on them, the questions being asked, and urgency. Examining one phone for a defined message thread is a fundamentally different job from reconstructing two years of conduct across a laptop, three cloud accounts and a file server. Expedited work — preserving a device this week before an employee departs — carries a premium but is almost always cheaper than losing the evidence.
Typical Engagement Shapes
A targeted single-device examination with a short findings letter sits at the smaller end. A full examination with court-ready expert report is a mid-sized engagement. Multi-device investigations, shadow-expert reviews through a hearing, and eDiscovery programs scale with the material. Data recovery is usually quoted per device after diagnosis, since the failure mode determines the work.
How We Keep It Controlled
Every Foren6ix engagement starts with confidential scoping and a written estimate before any work begins. We stage work where possible — preserve everything first (cheap), examine the most probative sources next, and expand only if findings justify it. You approve each stage; nothing proceeds on open-ended billing.
The Cost of Not Engaging an Examiner
The most expensive forensic outcomes we see are matters where evidence was handled informally first: an IT manager browsing a departing employee’s laptop, a spouse running a recovery app, a device wiped and reissued before anyone thought about litigation. What would have been a modest preservation exercise becomes an argument about spoliation — or a case that cannot be proven at all.
Getting a Real Number
Describe the matter in confidence — device types, roughly what is in dispute, timeline — and we will give you a written estimate within one business day. No obligation, and the scoping conversation itself is free.