Mobile and Digital Forensics
Data extraction, deleted data recovery, analysis, and reporting
Digital forensic services
Digital forensic services for legal and investigative matters
Rune Forensics provides forensic analysis, reporting, and expert support for matters involving phones, computers, cloud accounts, email records, business systems, and prior forensic work.
Services include civil litigation, criminal defense review, insurance matters, personal injury evidence, workplace investigations, business disputes, family law evidence, and independent review.
Based in Massachusetts, with forensic consulting available across New England and nationwide when the evidence and scope are appropriate.
Forensic services available
Most matters do not require every possible artifact. The work begins with the question that needs to be answered, then follows the devices, accounts, records, and systems that can address it.
Services are available for civil litigation, criminal defense review, insurance matters, personal injury claims, business disputes, internal investigations, family law matters, and independent expert review.
If the exact issue is not listed, send a brief summary. Digital evidence often crosses devices, accounts, applications, and records, and the first step is confirming what can be examined.
Computer Forensics
Forensic imaging, file system analysis, volume shadow copies, and email analysis
Drone Forensics
Flight logs, images, telemetry, and geolocation reconstruction
Surveillance Video Acquisition
Recovery, conversion, and authentication of video files
Audio, Video, and Image Forensics
Enhancement, metadata review, and authenticity verification
Internet, Social Media, and Cloud Analysis
Account activity, deleted communications, and data recovery
GPS and Location Data Analysis
Route mapping, timeline reconstruction, and location validation
Cell Site Location Information (CSLI) Analysis
Call detail record interpretation and mapping
Cellular Records Analysis
Call patterns, text logs, and subscriber information
Sensitive Data and Criminal Defense Evidence Review
Assessment of sensitive files, evidence handling, forensic findings, preservation procedures, and disputed digital evidence
Peer to Peer and Network Activity Review
Review of file sharing activity, IP records, account activity, attribution issues, and related forensic methods
Data Recovery
Recovery of damaged, deleted, or corrupted data from devices
Email Forensics
Header analysis, metadata review, recovery of deleted communications, business email compromise (BEC) investigations, and authentication of message origin and routing.
Malware and Unauthorized Access Analysis
Malware review, suspicious file analysis, indicators of compromise, account access patterns, and unauthorized activity review
Independent Analysis of Digital Evidence
Review and validation of forensic findings, devices, images, and reports
Expert Witness Services
Forensic reporting, affidavits, and testimony support for civil, criminal defense, insurance, workplace, and business matters
Focused service pages
Some matters benefit from a more specific explanation of the evidence, scope, and deliverables involved.
Digital Evidence in Civil Litigation
Digital forensic review for civil litigation involving phones, computers, cloud accounts, email records, files, metadata, timelines, and expert reporting.
Read moreDigital Forensics for Insurance Claims
Digital forensic consulting for insurance matters involving phones, computers, photos, videos, metadata, location records, communications, and timelines.
Read morePersonal Injury Digital Evidence Review
Digital forensic review for personal injury matters involving phone use, photos, videos, messages, location records, metadata, and timelines.
Read moreBusiness Email Compromise Investigation
Business email compromise forensic review involving mailbox rules, forwarding settings, logins, email headers, cloud records, and account activity.
Read moreIndependent Forensic Report Review
Independent forensic review of reports, extractions, timelines, devices, account records, methods, assumptions, findings, and limitations.
Read moreComputer Forensics Services
Computer forensic services involving laptops, desktops, file activity, internet history, deleted data, external devices, email records, and timelines.
Read moreDigital Evidence Is Time Sensitive
Digital evidence does not remain static. Devices continue to update, applications overwrite data, cloud accounts synchronize, and system logs may be replaced through normal use.
Delays in collection or analysis can result in the loss of potentially relevant information. Early preservation and review are often important when phones, computers, accounts, or online activity may be relevant to a matter.
Remote and nationwide consulting
Many forensic consulting matters can be handled remotely when evidence can be preserved, transferred, and reviewed through controlled procedures.
When in person work is required, scope, logistics, evidence handling, and transfer method are addressed before collection or analysis begins.
Frequently Asked Questions
Q: What is the difference between forensic collection and forensic analysis?
A: Forensic collection focuses on acquiring data in a way that preserves its integrity. Forensic analysis involves examining that data to identify relevant activity, artifacts, timelines, and limitations.
Q: Can deleted data always be recovered?
A: No. Deleted data may be recoverable in some cases, but recovery depends on the device, storage behavior, encryption, time passed, and continued use after deletion.
Q: What does a hash value prove?
A: A hash value can help verify that data has not changed since collection or analysis. It does not prove that the content itself is authentic or that the interpretation of the data is correct.
Q: Can malware or unauthorized access be identified through forensic analysis?
A: In some cases, yes. Analysis may identify indicators of compromise, suspicious files, unusual processes, login activity, or other artifacts that support or limit a conclusion.
Q: Why does timing matter with digital evidence?
A: Digital evidence can change through normal device use, application behavior, cloud synchronization, and log rotation. Delays may reduce what can be recovered or verified.
How the work is handled
Each matter is handled through a consistent forensic process from initial review through reporting. The scope of work is based on the devices, accounts, data sources, and questions that need to be answered.
Discuss Your Matter