Digital Forensic Services
Digital forensic services for legal and investigative matters
Rune Forensics provides forensic analysis, reporting, and expert support for matters involving phones, computers, cloud accounts, email records, business systems, and prior forensic work. The practice works with criminal defense attorneys on independent review of law enforcement extractions and reports, and supports civil litigation, insurance matters, personal injury, business disputes, and family law.
Discuss a MatterPractice Areas
Seven practice areas, organized by how a matter actually starts.
Most matters do not require every possible artifact. The work begins with the question that needs to be answered, then follows the devices, accounts, records, and systems that can address it. If the exact issue below is not listed, send a brief summary. Digital evidence often crosses devices, accounts, applications, and records, and the first step is confirming what can be examined.
Device & Data Forensics
Matter-Type Consulting
Supporting Capabilities
Further capabilities that support the practice areas above.
These capabilities are typically applied within broader forensic examinations and investigations rather than as standalone engagements.
Cloud and Online Evidence
Account activity, provider exports, social media and cloud records, synced data, and deleted communications where recovery is possible.
Email Records Review
Header analysis, metadata review, and evaluation of message origin and routing.
Unauthorized Access and Compromise Review
Account access, suspicious files, authentication records, indicators of compromise, and relevant user activity.
Criminal Defense Evidence Review
Independent review of law enforcement extractions and reports, evidence handling, preservation, and disputed digital evidence, with a focus on what the records support and what they do not.
Litigation and Expert Support
Forensic reporting, consultation, affidavits, and testimony support for criminal defense, civil, insurance, workplace, and business matters.
Digital evidence is time sensitive.
Digital evidence does not remain static. Devices continue to update, applications overwrite data, cloud accounts synchronize, and system logs may be replaced through normal use. Delays in collection or analysis can result in the loss of potentially relevant information.
Remote and nationwide consulting.
Many forensic consulting matters can be handled remotely when evidence can be preserved, transferred, and reviewed through controlled procedures. When in-person work is required, scope, logistics, evidence handling, and transfer method are addressed before collection or analysis begins.
Frequently Asked Questions
Questions about how the work is scoped and handled.
What is the difference between forensic collection and forensic analysis?
Forensic collection focuses on acquiring data in a way that preserves its integrity. Forensic analysis involves examining that data to identify relevant activity, artifacts, timelines, and limitations.
Can deleted data always be recovered?
No. Deleted data may be recoverable in some cases, but recovery depends on the device, storage behavior, encryption, time passed, and continued use after deletion.
What does a hash value prove?
A hash value can help verify that data has not changed since collection or analysis. It does not prove that the content itself is authentic or that the interpretation of the data is correct.
Can unauthorized access to an account or device be identified through forensic analysis?
In some cases, yes. Analysis may identify suspicious files, authentication records, login activity, and other indicators of compromise that support or limit a conclusion about who accessed what, and when.
Why does timing matter with digital evidence?
Digital evidence can change through normal device use, application behavior, cloud synchronization, and log rotation. Delays may reduce what can be recovered or verified.
Contact
How the work is handled.
Each matter is handled through a consistent forensic process from initial review through reporting. The scope of work is based on the devices, accounts, data sources, and questions that need to be answered.
Discuss Your Matter