Digital forensics for Montana organizations
When something has happened on a phone, a laptop or an email account, you need to know what actually took place before you decide what to do. We preserve the evidence with a documented chain of custody, examine it, and give you a written report you can act on.
Fixed preservation prices. Cellphone preservation is $850 per device, and analysis is $275 an hour.
Drop off, pickup or remote collection. Bring devices to our staff in Great Falls, Billings or Helena, or have phones collected remotely.
GIAC certified forensic analysts. Our team holds the GCFA, GCFE, GNFA and GCIH certifications.
Most forensics work starts with a person, not a hacker.
Most of the forensics work Montana organizations bring us falls into three groups. We work for organizations and the counsel advising them.
A departing employee may have taken files or client lists. A former business partner may have sabotaged systems on the way out. Or someone may be misusing company accounts.
You get
Facts about what was taken or changed, and when, before you make a decision about someone's job.
Business email compromise often leads to wire fraud. The mailbox and account history show how the attacker got in and what they did.
You get
A timeline of the compromise you can hand to your bank, insurer or counsel.
Now and then an insurance claim needs the facts established from a device or an account.
You get
Evidence preserved with chain of custody, and a written report.
Every investigation is covered by a nondisclosure agreement, and nothing we find is released without your prior approval.
Evidence rarely sits on one device.
A departing employee's files might be on a work laptop, a personal phone and a cloud account at the same time, so we look at whatever the question requires.
Cell phones
iPhone and Android, including messages, call history, photos and app activity where the device allows. Collected in person or remotely.
Computers and servers
Laptops, desktops and the servers your business runs on.
Email and cloud accounts
Microsoft 365, Google Workspace and cloud storage, preserved before anyone can change or delete what's there.
Social media accounts
Preserved with the same chain of custody as a device.
IoT devices
Cameras, door systems and other connected devices that record activity.
Network evidence
Logs and traffic that show what moved between systems and when.
How evidence is handled.
What can be recovered depends on the device, its settings and how much time has passed. That's why we triage first, and the full analysis only continues once you approve it.
01
Getting it to us
Drop it off with our staff in Great Falls, Billings or Helena, or we'll pick it up. Onsite collection on request, and phones can be collected remotely.
02
Preserving it
A forensic image of each device or capture of each account comes first, with a documented chain of custody, so the original evidence stays protected.
03
Triage
Based on what you've asked us to find, we take an initial look at what's there, including whether data was deleted and how recoverable it is.
04
Your go-ahead
We tell you what triage showed and estimate the analysis hours, for example about 10 hours to recover deleted data. Nothing more happens until you approve it.
05
Analysis
We complete the analysis, and look for related evidence you may not have thought of, like the GPS data in a photo, when it strengthens your case.
06
The report
A written report for your organization or your counsel. Most cases take about a week from collection to report; more data, or data deleted long ago, can take longer.
What every report includes.
Written for your organization or your counsel, so a business owner can follow it and counsel can rely on it.
Every report
Chain of custody
Each device and account
Documented from the first image or capture through to the report.
Every report
Timeline and analysis
Event by event
A full timeline of the events the evidence shows, with detailed analysis down to details like the GPS data inside photos.
Every report
Executive summary
Plain language
What was found and what it means, written for the people making the decision.
Every investigation is covered by a nondisclosure agreement. No data or findings are released without your prior approval.
Digital forensics, priced before we start.
Preservation is a fixed price, so you know the cost of protecting the evidence before anything else happens. Analysis is billed by the hour with no expedite fees.
Phones
$850 per device
Cellphone preservation. Remote iPhone or Android acquisition is $950 per device, and a full file system extraction is $2,100.
Fixed price
Computers and accounts
$1,150 per device
Computer preservation. Email or cloud account preservation is $600 per account, and social media accounts start at $450.
Analysis
$275 an hour
$150 an hour for returning clients. Evidence storage drives are $120 per 1 TB drive.
Certified forensic analysts, based in Montana.
Our forensics and incident response work is done by certified staff. Big Sky Cybersecurity is Montana owned and women owned, and our team has supported Montana organizations since 2013 through Schoolhouse IT.
GIAC certified
Our team holds the GCFA, GCFE, GNFA and GCIH forensics and incident handling certifications, along with CISSP, CySA+, CEH and PenTest+.
You stay involved
Once the evidence is preserved, we work with you to decide what data your case needs. Nothing goes past triage without your approval.
Close by
Drop devices off with our staff in Great Falls, Billings or Helena, or we'll pick them up. Onsite collection on request.
Two situations we handle differently.
If either of these describes you, start here.
The Madison River near Ennis, Montana
Frequently asked questions
Can deleted text messages be recovered?
Sometimes. It depends on the phone, its settings and how long ago the messages were deleted. After we preserve the phone, we triage it and tell you what's realistic before the full analysis starts.
Do you need the phone itself?
Not always. We can collect iPhones and Android phones remotely, with a documented chain of custody, so the owner keeps their phone.
How long does a forensic investigation take?
Most cases take about a week from collection to written report. More data, or data deleted long ago, can take longer. After triage we give you an early estimate of the analysis hours.
Do you work anywhere in Montana?
Yes. You can drop devices off with our staff in Great Falls, Billings or Helena, we can pick them up, or we can come onsite on request.
Can I hire you as an individual?
We typically work through your attorney or with their approval. Talk with your attorney first, and they can contact us.
Is the investigation confidential?
Yes. We sign a nondisclosure agreement for every case, and no data or findings are released without your prior approval.