Your competitors don't give details of their expertise or their rates on their websites, why does RTSI?

We've been in the digital forensics business longer than most other companies in the United States; we believe in being upfront about everything. We know that your time is valuable and don't want to waste it. Putting the information on the website allows you to decide upfront, without having to call or email for information, whether we are what you are looking for.

While anyone can buy computer forensic software and take a class to learn the basics of using it, becoming a proficient examiner, much less an expert, requires many years of experience.

Why are "Company XYZ's" rates so much cheaper than yours?

Most competent computer forensic examiners charge between $200 and $400 per hour. Companies that are charging significantly less typically do so because they lack the experience to be able to charge the standard rates. As with many things in life, quality costs more.

Frequently, these examiners have purchased a single piece of forensic software and possibly taken a class to learn its basic use. True forensic examiners will have a vast number of forensic tools available and will have been to many training classes.

Why should we choose you to examine our computer?

We have decades of experience in the recovery of computer data, computer forensics, and computer related investigations. Our clients include corporations of all sizes, as well as state and federal agencies.

We regularly provide expert testimony in state and federal courts concerning computer forensic examinations. We provide training to law enforcement officers (city, county, state, federal, and military) around the country in the investigation computer crimes and computer forensics.

We are the ones that other forensic examiners turn to for assistance. If it is important enough to use computer forensics, it is critical to use the best.

You're in Florida, wouldn't it be cheaper to get someone who is local?

We have clients throughout North America and Europe. Most of our cases never require any travel; the client ships the hard drive(s) to us. In civil cases, we frequently find evidence that causes the other side to seek settlement.

The most important factor in selecting a computer forensic examiner shouldn't be geography. There are a very limited number of truly qualified firms across the United States in the computer forensics field. Many of the major cities in the U.S. don't have any qualified individuals in the private sector.

Hiring the best qualified examiner may cost more initially, but is there any value in an incomplete examination? Only the best examiners can provide thorough examination and interpretation.

We have computer personnel in our company, why shouldn't we let them conduct the examination?

Although they may have a considerable amount of knowledge and experience with computers, perhaps even data recovery, it is highly unlikely that they have the requisite knowledge of the forensic protocols that must be observed to find all of the evidence, protect the data, and ensure the admissibility of evidence in civil or criminal trials. We take steps to safeguard the computer data; these steps require specialized training, hardware, and software. We have the training, experience, and tools to conduct a thorough examination of computer data and are able to interpret what we find.

In addition to the lack of skills, hardware, and software, using a company employee can open you up to allegations of fabricating evidence and other impropriety. We are an independent firm and integrity is the keystone of our company.

Can your employee qualify in court as an expert in the forensic examination of a computer? Probably not. Assuming their findings were not suppressed, they would only be allowed to testify to facts. They would not be allowed to testify to opinions or conclusions. Our expertise has already been recognized by state and federal courts around the country.

We often receive computers to examine after a company's computer personnel have attempted to recover evidence from it. In their attempts they have destroyed important evidence such as the date that files were last accessed. The forensic processes and hardware that we utilize are designed to safeguard every bit of evidence.

We don't plan on going to court. We're just looking for what an employee has been utilizing a computer for. Isn't it ok to use in-house computer personnel to do this?

If your concerns are strong enough to warrant the examination of a computer, then it is important to do it right. If the employee is fired or disciplined as a result of the examination, civil litigation will likely follow. We can provide you with the documentation and expert testimony that are necessary to substantiate your actions. Our vast experience allows us to not only find the evidence, but to interpret its meaning.

We are working with a Private Investigative company. Why can't they examine computers for us?

While there are many tens of thousands of Private Investigators around the country, the examination of computers is far beyond the skills and training of all but an extreme few. There are many specialties in Private Investigation; just because an investigator has excellent credentials for conducting financial investigations does not mean that they are qualified to examine computers. If you are going to pay someone to recover computer evidence, pay a professional examiner. With our expertise and tools, we can recover evidence that others wouldn't even know to look for.

Can we use a data recovery firm for doing computer forensics?

Some data recovery firms may have qualified forensic examiners; most probably do not. While some of the same skills and software are used in both computer forensics and data recovery, computer forensics requires extensive additional knowledge and experience. Remember, a forensic examiner is not only finding the data, but is also providing expert analysis of what they find. This expert opinion must be capable of standing up under intensive cross-examination. Likewise, you need to know the qualifications of the person(s) that will actually perform the examination rather than the collective qualifications of all of the examiners at the company. When it comes time for testimony, the individual examiner's qualifications, not the company's, will be under scrutiny.

We already have a relationship with a major accounting firm that says they can do computer forensics. Why can't they examine computers for us?

There are some excellent forensic examiners working for the major accounting firms. There are also some unqualified individuals being passed off as qualified. As with a data recovery firm or any other firm, the qualifications of every individual that will be involved in your case must be known in advance. Also be wary of a typical billing scheme that involves having multiple people "review" findings so that they can add the billable hours.

What qualifications should we look for in a computer forensic examiner?

There is an ever increasing number of people hanging out their shingle as computer forensic examiners. Some are among the most qualified individuals in the country; others are opportunists, lacking expertise, who believe they can make fast money. Some factors to consider include:

• How long has the examiner been doing computer forensic examinations and how many have they done? If your situation is important enough to require computer forensics, it is important enough to not entrust it to someone who has just taken a course or two and has very little practical experience.

• Is the person a former law enforcement, government, or military examiner? (Note: not just a former member of one of those organizations, but someone that actually did examinations for the organization.) The best forensic training was historically only available to these groups. Examiners in this group have been trained in proper evidence handling and documentation. They are accustomed to operating at a proof level of beyond a reasonable doubt. They are also more likely to have a greater amount of courtroom experience.

• While computer forensics requires the ability to think logically, it also requires investigative instincts. Examiners that are former law enforcement investigators have honed these skills. An examiner that does not have an investigative background may think logically, but probably lacks the investigative instincts.

• Has the person been accepted in court as an expert in computer forensics? How many times? Federal Court? Can they provide references by attorneys as to their testifying abilities? Has their expertise withstood appellate review?

• Are they a member of any computer forensic related organizations? These include: Florida Association of Computer Crime Investigators (Mr. Rehman is President of this organization); High Tech Crime Network; High Tech Crime Investigations Association (Chapters nationwide); International Association of Computer Investigative Specialists (provides forensics training only to law enforcement- only people trained by IACIS can belong); Computer Forensic Information Digest (an email list); and Forensic Association of Computer Technologists (upper Midwest). These organizations provide cutting edge information that is necessary for any true forensic examiner to stay current.

• Another issue is the forensic processing software used by the examiner. Some firms, including at least one of the larger ones, are using dated analysis methods that result in their examinations taking significantly more time than firms using state of the art methods. Greater examination times mean far greater costs to the client.

• Verify claims of experience; there are many charlatans claiming to be experienced computer forensic examiners. When you look closely at their claimed training and experience, you quickly find that they have grossly exaggerated their limited, or even non-existent, qualifications.

What does it cost?

We charge $300/hour for forensic analysis and require a $5000 retainer for ordinary cases (a single PC or Mac with an 80 gigabyte hard drive). An average examination generally takes a minimum of 30 hours, though this can vary greatly for any given situation. Factors that effect the amount of time required include: the amount of data to search (i.e.: hard drive size, number of CD's, etc.); volume of material; encryption; data hiding; and attempts as destroying the data. Call us for more details; there is no charge for the initial consultation. Our Rates, Terms, and Standard Agreement are available by clicking on the link below the next FAQ.

Why do you require a $5,000 nonrefundable retainer?

We are often asked to perform less than a complete analysis or to limit our hours in an effort to minimize the cost. We cannot honor these requests because we will not conduct less than a thorough analysis. Doing so shortchanges the client: all of the evidence sought is not found because insufficient time is allocated to the examination. It also places our reputation in jeopardy: if we do not find evidence that is present, it reflects poorly on us, even though our client asked us to limit our hours.

In our experience, the thorough examination of a computer is going to take at least 20 hours. If the potential client is not willing or able to invest this minimum amount, we are probably not the correct firm for them.