Methodology
A defensible, repeatable five-step forensic process.
Every Teradrive engagement follows the same five-step process, regardless of service or matter type. The process is documented in every report and designed to withstand cross-examination in Canadian courts.
The strength of any forensic finding depends on the methodology that produced it. Two examiners can reach different conclusions from the same device if they used different tools, different acquisition methods, or different parsing logic. Methodology is what makes a finding reproducible and defensible under cross-examination. We publish the five-step process below so counsel and clients can validate it before the engagement begins.
Scoping & intake
- Counsel- or client-led intake under privilege
- Conflict check and engagement letter
- Custodian and data-source mapping
- Documented preservation plan
Before any forensic work begins, we agree on the matter, custodians, devices, timeline, and deliverable. A conflicts check confirms independence. Engagements taken through counsel are structured to support a litigation-privilege claim. The output is a written scoping memo signed by both sides.
Forensic acquisition
- Hash-verified imaging at our Langley main office or on-site
- Write-blockers, validated tools, sealed evidence bags
- Chain-of-custody log started at first contact
- Advanced techniques (chip-off, JTAG, ISP) when needed
Acquisition creates a defensible bit-for-bit copy of the source evidence. Hardware write-blockers for traditional media. Cellebrite, Magnet AXIOM, or advanced extraction (chip-off, JTAG, ISP) for mobile. Native cloud-platform collection tooling for cloud. Hash values are recorded at acquisition and verified at every subsequent handling.
Examination & analysis
- Examination performed only on forensic copies
- Multiple tools cross-validated
- Documented examiner notes throughout
- Findings reviewed by a second examiner
Analysis runs on a working copy, never on the original. Named industry tools document every analytical step so the work is reproducible by another examiner. Findings tie to specific exhibits with timestamps, source artifacts, and methodology disclosure. Every step is logged for chain of custody.
Reporting
- Examiner report written for non-technical decision-makers
- Exhibits with hash values and provenance
- Affidavit available where matter requires it
- Prepared to support cross-examination
The deliverable is a written examiner report structured for the audience that will read it. Counsel reports follow BC Supreme Court Civil Rule 11 form by default. Corporate reports include executive summaries and technical appendices. Where the matter requires sworn evidence, an affidavit accompanies the report.
Production & archive
- Production in agreed format (PDF, native files, load-file equivalent, etc.)
- Sealed evidence returned or held under retention agreement
- Audit trail preserved for matter lifecycle
- Secure destruction on written instruction
The original evidence stays sealed under documented chain of custody. Working copies are retained on encrypted storage with retention agreed at scoping. Custodian declarations and chain-of-custody affidavits are available on request. Release, transfer, or destruction happens only on counsel's instruction.
Standards alignment
Aligned to Canadian and international guidance.
- Documented chain-of-custody procedures for every exhibit
- RCMP Technical Operations evidence-handling principles
- Canadian rules of evidence (Federal & BC)
Need digital evidence handled defensibly?
Book a confidential consultation. Our team will reach out as soon as possible.