Digital Forensics
Rapid Field Triage
On-scene assessment that establishes what a device holds and whether a full examination is warranted — before the meter runs.
Know what you have before you commit
Not every device justifies a full forensic examination, and not every matter can wait for one. Field triage answers the immediate question — is the relevant material here at all — quickly enough to inform a decision that same day.
Triage is performed to the same evidentiary standard as full examination, so nothing done at this stage compromises a later deep dive. Where triage shows the material is present, the device moves into full acquisition with the chain already documented.
What we deliver
On-Scene Assessment
Rapid establishment of what a device holds, performed at your location where required.
Scope Decision Support
Clear answer on whether full examination is justified before the larger cost is committed.
Evidence Preservation
Triage performed without compromising a later full acquisition or the chain of custody.
Multi-Device Prioritization
Where several devices are in play, triage establishes which ones matter.
The problem triage solves
An investigation starts and there are fourteen devices. Two laptops, a desktop, three phones, a NAS, some external drives, a tablet nobody can account for. Full forensic examination of all of them is neither affordable nor sensible, and choosing between them on instinct is how a budget gets spent on the wrong hardware while the right one sits in a drawer being forgotten.
Rapid field triage is the assessment step that comes first: an examiner on site, working through the devices quickly and defensibly, to establish which ones contain material relevant to the question — and, just as usefully, which do not. The output is a prioritised list and a preservation plan, so that full examination is commissioned deliberately rather than by default.
It is also frequently a time-critical step. Devices in an office are being used, reissued, wiped and taken home while a decision is being made. Getting an examiner in front of them early preserves options that disappear within days.
What happens on site
Inventory and documentation. Every device recorded — make, model, serial, condition, power and lock state, location, who was using it, who has touched it since. This alone resolves a surprising number of later arguments about what existed and where.
Volatile capture where it matters. A running machine may hold encryption keys, active sessions and process history that vanish on shutdown. Deciding whether to capture memory is a judgement made on site, and it cannot be made later.
Preview, not full analysis. Write-protected preview to establish whether relevant material is present — a keyword and date-range look at file listings, recent activity, connected device history, mail presence and account artefacts. Enough to answer “does this device matter”, not enough to answer “what does it prove”.
Selective preservation. Imaging on the spot where the device is relevant and cannot be taken, targeted collection where a full image is disproportionate, and a documented decision where a device is set aside — including the reasoning, because a device that was examined and excluded is a much stronger position than a device nobody looked at.
Chain of custody from the first minute. Seals, signatures, transfer records. Triage is not an informal look around; it is the beginning of the evidential record, and it is written that way.
Where it earns its cost
Employee departures and internal investigations, where several devices are in play and the organisation needs to move before machines are reissued.
Incident response, where the first question is which systems were touched, and answering it quickly shapes the entire containment effort.
Multi-device family law and civil matters, where a household or a business has accumulated hardware and a full examination of everything would exceed the value of the dispute.
Regulatory or law enforcement contact, where an organisation needs to understand its own position quickly and accurately.
Any matter with a real budget ceiling. Which is most of them. Triage is how a limited budget gets spent on the two devices that matter instead of spread across nine that do not.
The honest limits
Triage answers relevance, not substance. It will tell you that a machine shows heavy USB activity in the fortnight before a resignation; it will not tell you what was on the stick. It will tell you that a mailbox contains messages with a counterparty; it will not produce the analysis of them. Those answers come from full examination, and triage exists to tell you which examination to buy.
It is also not a substitute for preservation. A device that triage identifies as relevant is imaged, not returned to service with a note. And a device that triage excludes should still be held, not wiped, until the matter closes — an exclusion decision made on preview can occasionally need revisiting when the question changes.
Where a device is locked and the passcode is unknown, triage will establish that quickly rather than after a week of billed effort — which is itself a useful and money-saving finding.
How it fits with the rest
Triage feeds directly into computer forensics, mobile forensics and cloud extraction for the devices and accounts it identifies. Where custodians are distributed, the same prioritisation logic runs through remote collection instead of on site. Methodology, standards and chain of custody practice are as set out on the digital forensics page.
How it is priced
Quoted per day or per half-day on site, with device count and location as the drivers. Imaging performed during triage is quoted per device. Travel outside the metro is additional. For most multi-device matters, the triage fee is recovered several times over in examinations not commissioned.
Included: inventory and documentation, volatile capture where warranted, write-protected preview, a prioritised findings summary with reasoning, a preservation plan, and chain of custody for everything handled. Quoted separately: full examinations arising, additional days, and testimony.
Frequently asked questions
We have a dozen devices and a limited budget. Where do we start?
Here. A day of triage typically identifies the two or three devices that carry the answer and documents why the rest do not — which is both cheaper than examining everything and a stronger position than examining some of it arbitrarily.
Does triage give us the answer?
No. It tells you which device holds the answer and whether the question is reachable at all. Substance comes from full examination. Triage exists so you buy the right examination rather than all of them.
Can you come to us?
Yes — that is the point of field triage. On site, with devices staying in the building, which matters when an organisation cannot have hardware disappear without the whole office noticing.
What if a device turns out not to be relevant?
That is a genuine finding and it is documented with its reasoning. Hold the device rather than wiping it until the matter closes — questions change, and an exclusion decision occasionally needs revisiting.
Should machines be left on or off before you arrive?
Leave them exactly as they are, and tell us the state when you call. A running machine may hold keys and session data that vanish on shutdown; a powered-off encrypted machine may be unreachable. Whether to capture memory is a decision that can only be made once.
Is triage defensible, or is it just a look around?
Defensible, and written to be. Write-protected preview, full inventory, documented decisions with reasoning, and chain of custody from the first minute. A device examined and excluded on the record is a much stronger position than one nobody looked at.
Who this is for
- Law firms
- Corporate incident response
- HR investigations
- Insurers
- Multi-device matters
- Time-critical decisions
Scope your requirement
Tell us how many devices are involved and where they are. Triage is scoped by device count and the deadline you are working against.
Before the examiner arrives
Holding the line between the call and the site visit
The gap between deciding to call an examiner and the examiner walking in is where evidence is most often lost, usually by well-meaning IT staff following normal routines. A few instructions, given early, keep options open.
Pause automated clean-up
Ask IT to hold off on reimaging, account deprovisioning, and mailbox deletion for the people involved. Standard offboarding scripts can destroy exactly what triage is meant to find.
Suspend remote wipe commands
Devices enrolled in device management can be wiped remotely, sometimes on a schedule. Confirm no wipe or retire action is queued against the devices in question.
Isolate phones from the network
A connected phone can receive a remote wipe or sync away data. Keeping it powered and charged while shielded, for example in Faraday bags, preserves its state without switching it off.
Limit who touches what
Every person who opens a laptop or scrolls a phone adds activity to it and becomes part of the chain of custody. Keep a short list of anyone who has handled a device.
Gather credentials and ownership
Collect known passcodes, admin credentials, and records showing who owns each device. Locked or personally owned hardware changes what can be done on the day.
Our guide on preserving digital evidence before hiring an examiner covers these steps in more detail.
Authority and scope
Who can authorize triage, and on which devices
Technical soundness is only half of defensibility. The other half is whether the person who authorized access to a device had the right to do so. That question is easiest to answer before anyone plugs anything in.
- Company-owned hardware is usually the simplest case, particularly where written policy says devices and accounts belong to the organization.
- Personally owned phones and laptops generally need the owner’s consent or a court order, even if they hold work data. Our page on BYOD device forensics for employers explains the usual approaches.
- Shared household devices in family and civil matters raise questions about joint ownership and other users’ data, and should be cleared with counsel first.
- Preservation duties can arise once litigation is reasonably anticipated. Under Federal Rule of Civil Procedure 37(e), failing to preserve electronically stored information can carry consequences, so triage is often paired with a formal legal hold.
This is general information, not legal advice. Where ownership or consent is unclear, we document the question and wait for counsel’s direction rather than proceed.
More questions
Further questions about field triage
What should we tell you about the question we are trying to answer?
The names of the people involved, the date range that matters, and what you think happened, such as files taken or messages sent. Triage is only as focused as the question behind it, and vague scope produces vague prioritization.
Our IT team could just look through the machines. Why not do that?
An internal look often changes timestamps, logs, and recent-activity records, and the person doing it may later have to explain their actions as a witness. Write-protected preview by an independent examiner avoids both problems.
What if some devices or custodians are in other locations?
Devices at other sites can be triaged on a follow-up visit, or custodians can be handled through remote forensic extraction so everyone is prioritized by the same criteria.
What does the written triage output look like?
A device-by-device table showing identification details, what was checked, whether relevant material appears present, the preservation action taken, and the reasoning. It is written to be read by counsel and decision-makers, not only by technical staff.
How quickly can triage be arranged?
That depends on device count, location, and scheduling. Use the consultation page with the number of devices and your deadline.