Know what you have before you commit

Not every device justifies a full forensic examination, and not every matter can wait for one. Field triage answers the immediate question — is the relevant material here at all — quickly enough to inform a decision that same day.

Triage is performed to the same evidentiary standard as full examination, so nothing done at this stage compromises a later deep dive. Where triage shows the material is present, the device moves into full acquisition with the chain already documented.

What we deliver

The problem triage solves

An investigation starts and there are fourteen devices. Two laptops, a desktop, three phones, a NAS, some external drives, a tablet nobody can account for. Full forensic examination of all of them is neither affordable nor sensible, and choosing between them on instinct is how a budget gets spent on the wrong hardware while the right one sits in a drawer being forgotten.

Rapid field triage is the assessment step that comes first: an examiner on site, working through the devices quickly and defensibly, to establish which ones contain material relevant to the question — and, just as usefully, which do not. The output is a prioritised list and a preservation plan, so that full examination is commissioned deliberately rather than by default.

It is also frequently a time-critical step. Devices in an office are being used, reissued, wiped and taken home while a decision is being made. Getting an examiner in front of them early preserves options that disappear within days.

What happens on site

Inventory and documentation. Every device recorded — make, model, serial, condition, power and lock state, location, who was using it, who has touched it since. This alone resolves a surprising number of later arguments about what existed and where.

Volatile capture where it matters. A running machine may hold encryption keys, active sessions and process history that vanish on shutdown. Deciding whether to capture memory is a judgement made on site, and it cannot be made later.

Preview, not full analysis. Write-protected preview to establish whether relevant material is present — a keyword and date-range look at file listings, recent activity, connected device history, mail presence and account artefacts. Enough to answer “does this device matter”, not enough to answer “what does it prove”.

Selective preservation. Imaging on the spot where the device is relevant and cannot be taken, targeted collection where a full image is disproportionate, and a documented decision where a device is set aside — including the reasoning, because a device that was examined and excluded is a much stronger position than a device nobody looked at.

Chain of custody from the first minute. Seals, signatures, transfer records. Triage is not an informal look around; it is the beginning of the evidential record, and it is written that way.

Where it earns its cost

Employee departures and internal investigations, where several devices are in play and the organisation needs to move before machines are reissued.

Incident response, where the first question is which systems were touched, and answering it quickly shapes the entire containment effort.

Multi-device family law and civil matters, where a household or a business has accumulated hardware and a full examination of everything would exceed the value of the dispute.

Regulatory or law enforcement contact, where an organisation needs to understand its own position quickly and accurately.

Any matter with a real budget ceiling. Which is most of them. Triage is how a limited budget gets spent on the two devices that matter instead of spread across nine that do not.

The honest limits

Triage answers relevance, not substance. It will tell you that a machine shows heavy USB activity in the fortnight before a resignation; it will not tell you what was on the stick. It will tell you that a mailbox contains messages with a counterparty; it will not produce the analysis of them. Those answers come from full examination, and triage exists to tell you which examination to buy.

It is also not a substitute for preservation. A device that triage identifies as relevant is imaged, not returned to service with a note. And a device that triage excludes should still be held, not wiped, until the matter closes — an exclusion decision made on preview can occasionally need revisiting when the question changes.

Where a device is locked and the passcode is unknown, triage will establish that quickly rather than after a week of billed effort — which is itself a useful and money-saving finding.

How it fits with the rest

Triage feeds directly into computer forensics, mobile forensics and cloud extraction for the devices and accounts it identifies. Where custodians are distributed, the same prioritisation logic runs through remote collection instead of on site. Methodology, standards and chain of custody practice are as set out on the digital forensics page.

How it is priced

Quoted per day or per half-day on site, with device count and location as the drivers. Imaging performed during triage is quoted per device. Travel outside the metro is additional. For most multi-device matters, the triage fee is recovered several times over in examinations not commissioned.

Included: inventory and documentation, volatile capture where warranted, write-protected preview, a prioritised findings summary with reasoning, a preservation plan, and chain of custody for everything handled. Quoted separately: full examinations arising, additional days, and testimony.

Frequently asked questions

Who this is for

• Law firms
• Corporate incident response
• HR investigations
• Insurers
• Multi-device matters
• Time-critical decisions