Planning a forensic engagement
What affects the cost of digital forensics in BC?
Every matter is different, so we do not publish a price list. Instead, we quote each engagement in writing after a free consultation. This page explains what actually drives the work, so you know what to expect and how to keep the scope focused.
The main factors behind the estimate
How many devices and accounts are involved
One phone is a very different job from three laptops, two phones and a shared cloud drive. Each device or account needs its own preservation, imaging and verification, so the number of sources is usually the biggest single driver.
The type of device
A recent computer with a standard drive is usually straightforward to image. Some phone models, tablets, vehicles, servers and specialty storage need specific tools or extra steps before data can be collected in a defensible way.
Locks, passcodes and encryption
If a device is locked and no passcode is available, or the data is encrypted, the work can take longer and may need advanced techniques. Having passcodes and account credentials ready at intake often shortens the job noticeably.
Deleted, damaged or hidden data
Reviewing what is on a device is simpler than reconstructing what someone tried to remove. Recovering deleted messages, analysing wiped drives or working with a physically damaged device adds examination time.
Cloud and email sources
Microsoft 365, Google Workspace, iCloud and similar services hold evidence that never touches the device. Collecting audit logs and mailboxes depends on access, retention settings and how far back the matter goes.
The questions you need answered
A narrow question (did this file leave the company on this date?) is faster to answer than an open review of everything on a device. A clear scope keeps the engagement focused and the estimate tight.
Reports, affidavits and testimony
A short findings summary takes less time than a full expert report prepared under the BC Supreme Court Civil Rules. Affidavits, responding to the other side's expert and attending court or discovery are scoped separately.
Urgency
Court deadlines, preservation orders or an active incident may require us to prioritise your matter or work outside normal hours. Standard timelines generally cost less than rush work.
Where the evidence is
Devices brought or couriered to our Langley lab are the simplest arrangement. On-site collection at an office or another city, or a remote collection, involves additional coordination.
Common questions about cost
Why don't you publish prices?
Two matters that sound the same can need very different amounts of work. Rather than quote a number that may not fit your file, we review the details and give you a written estimate before any work begins.
How do I get an estimate?
Book a free, confidential consultation. Tell us the devices or accounts involved, what you need to establish and any deadlines. We confirm the scope and send a written estimate.
How are engagements usually structured?
Single-device matters are typically handled as a defined-scope engagement with a written estimate. Larger or evolving matters are billed by the hour against an agreed estimate, and we check in before going beyond it.
How can I keep the cost down?
Preserve the devices as they are, gather passcodes and account details, and be as specific as you can about the questions you need answered and the time period that matters.
See our services and methodology for how each engagement is carried out.
Get a written estimate for your matter
Contact us for a free, confidential consultation. We review the details and send a written estimate before any work begins.