About Rune Forensics | Independent Digital Forensic Consulting

Core position

The evidence determines the opinion.

Rune Forensics is retained to examine records, artifacts, metadata, logs, account data, device activity, and technical findings. The work is not to validate a preferred conclusion.

An examination may support an allegation, weaken it, contradict it, or show that the available records cannot answer the question. The same standard applies regardless of who retained the firm.

Independence in practice

Objectivity is practical, not decorative.

Independent work means the evidence is evaluated on its own terms. It does not mean agreement with the retaining party, automatic disagreement with another examiner, or avoiding uncertainty when the record has limits.

Evidence before conclusions

Opinions are developed from source artifacts, metadata, logs, databases, account records, and documented technical findings.

No predetermined outcome

An engagement does not begin with an assumption that an allegation is true or false.

Agreement where supported

A prior report or opposing examiner may be correct. Independent review means evaluating the work fairly.

Disagreement where required

Unsupported conclusions, omitted context, missing records, or overstated interpretations should be identified clearly.

Uncertainty reported honestly

If the available evidence cannot answer the question, the report should say so.

Objective reporting

What the report should make clear

A forensic report should help another reviewer understand what was examined, what was found, what was not available, and how strongly the data supports the conclusion.

Observations separated from opinions

The report should distinguish what the record shows from what the examiner concludes from it.

Findings tied to identifiable records

Important findings should be connected to source artifacts, metadata, logs, databases, account records, or other reviewable material.

Tool output checked when important

Forensic tools are useful, but tool labels and summaries may need comparison against the underlying artifact.

Limits stated at the right point

Missing evidence, acquisition limits, tool limits, attribution limits, and alternate explanations should be disclosed when they affect the opinion.

Independent analysis

Evidence Determines the Opinion

An independent forensic examination does not begin with a conclusion. It begins with the available records and the question those records are being asked to answer.

Sometimes the evidence supports the allegation.

Sometimes it contradicts it.

Sometimes it answers only part of the question.

Sometimes it cannot answer the question at all.

Each outcome is a valid forensic result when it is supported by the record.

Findings are based on source artifacts, documented records, and accepted forensic methodology. The same care is applied whether the result helps the retaining party, complicates the theory of the matter, or shows that the available data has limits.

Independent forensic work means reporting what the evidence supports, no more and no less. Limitations are reported as clearly as findings because both affect the strength of any opinion.

Matters supported

Forensic consulting for disputed digital evidence.

Rune Forensics supports matters involving mobile devices, computers, cloud accounts, email records, metadata, timelines, business systems, prior forensic reports, extractions, and disputed technical conclusions.

Civil litigation evidence Business investigations Business email compromise Independent forensic review Insurance claims evidence Personal injury evidence

Founder

A focused forensic practice.

Rune Forensics was founded by Alexander Harbitz, a digital forensic examiner with experience in government forensic work, law enforcement investigations, reporting, testimony, and instruction.

View examiner qualifications and experience

Consultation

Need an independent assessment of the digital evidence?

The first step is identifying the question, the available records, preservation concerns, and the limits of the requested examination.

Request consultation