For attorneys
Support for discovery, expert review, affidavits, deposition preparation, hearing strategy, and trial preparation.
About
An independent forensic consulting practice for serious digital evidence matters.
Forensic analysis for attorneys, businesses, and individuals working with digital evidence.
Point of view
Evidence first, opinion second.
Rune Forensics is led by Alexander Harbitz, a digital forensic examiner with experience in forensic casework, report writing, testimony, law enforcement investigations, and digital forensics education.
Digital evidence is rarely as simple as a screenshot, a message thread, or a tool generated report. Phones sync with cloud accounts. Email systems keep partial records. Computers retain artifacts that can be easy to overread. A forensic opinion should respect that complexity without making the client wade through noise.
Rune Forensics was built around a restrained model of consulting: define the question, preserve the relevant evidence, evaluate the source records, document the limits, and explain the findings in a way that attorneys and clients can use.
The work is intentionally serious. No alarmist language, no generic cyber gloss, no unsupported certainty. Just focused analysis of what the digital record can and cannot establish.
Built for attorneys and clients
Technical evidence has to become usable work product.
For businesses
Controlled review of employee activity, account compromise, data access questions, internal investigations, and business disputes.
For individuals
Independent review of digital evidence in civil, criminal, family, employment, and private matters.
For contested reports
Evaluation of prior forensic work, extractions, screenshots, tool output, and opposing expert interpretations.
Principles
How the work stays useful.
Scope before analysis
Good forensic work starts with the relevant legal or business question.
Context before conclusion
Artifacts are interpreted against source records, device behavior, account settings, and timing.
Clarity before volume
Clients receive the analysis needed to act, not an unfiltered dump of technical output.
Restraint before certainty
When evidence has limits, those limits are part of the opinion.