The words "quick" and "forensics" should not appear next to each other ever. If "quick" is the most important functional requirement, then forensics is off the table. Reputable firms don't take standalone engagements for "5 hours of forensic analysis." 1/n
The reason is that we know we can't get usable results to you in 5 hours. Remember, we have to write a contract, access the media, image the media, process the media, analyze the evidence, write a report, and brief the report. All of this takes time. 2/n
On this note, if you have a firm promising you answers in 5 billable hours, this is a real warning sign. Run away. I often get usable results in 5 hours of analysis, but:
1. That's not including all that other stuff I have to do.
2. That's not a full forensic exam.
3/n
1. That's not including all that other stuff I have to do.
2. That's not a full forensic exam.
3/n
All firms have a floor on "what's the smallest job you'll take." Some people like the "no job is too small" infomercial approach, but that's just not reality. That might work for some handymen, but it doesn't work for forensics. 4/4
