Attorney Resources
Practical digital-evidence resources for criminal defense, family law, workplace investigations, and civil litigation. AMR Digital Forensics helps counsel identify relevant evidence, plan preservation, and understand what forensic findings can—and cannot—establish.
Discuss your matter confidentially · 866-274-0336
Choose your matter type
Criminal defense
Independent review of mobile devices, computers, forensic reports, GPS and location artifacts, communications, photographs, and video. Identify missing source material, test reported timelines, and evaluate tool-generated conclusions against the underlying evidence.
Explore Criminal Defense Resources · Independent CSAM Image & Video Review
“In high-stakes litigation against prosecutors with well-funded and well-trained law enforcement experts, AMR levels the playing field.”
—Clayton Campbell, Criminal Defense Attorney
Family law
Support for disputed messages, account access, device activity, photographs, metadata, locations, and custody-related timelines. We document supported observations and distinguish device or account activity from assumptions about the person responsible.
“AMR’s ability to break down a two-dimensional series of videos to illustrate the truth of a three-dimensional interaction was critical to the success of the case.”
—Seth N. O'Dell, Family Attorney
Employment & workplace investigations
Targeted preservation and analysis of workplace communications, devices, account access, deleted data when recoverable, document provenance, and activity timelines.
Explore Workplace Investigation Resources
Civil & business litigation
Analysis of disputed documents, electronic signatures, deleted communications, metadata, account access, and discovery sources. Establish a focused scope around the technical questions counsel needs answered.
Explore Civil Litigation Resources · DocuSign & Electronic-Signature Investigations
Focused forensic resources
Mobile-device forensics: acquisition, communications, application artifacts, metadata, and limitations of extraction reports.
DocuSign investigations: audit trails, completion certificates, timestamps, IP activity, and disputed electronic signatures.
Independent CSAM review: file classification, unique-file counts, duplicates, report review, and authorized evidence access.
Emergency evidence preservation: coordinate time-sensitive devices, accounts, logs, messages, and other evidence sources.
Before your first consultation
Prepare a concise summary so the discussion can focus on the evidence and upcoming deadlines:
Matter and deadlines: case type, procedural stage, hearing dates, discovery deadlines, and immediate preservation concerns.
Conflict review: names of the parties and other relevant entities before substantive case materials are provided.
Evidence sources: available devices, account providers, forensic images, extraction reports, exports, and chain-of-custody records.
Technical questions: the specific communication, document, signature, location, event, or report conclusion that requires examination.
Authority and deliverables: who can authorize access, any orders or access restrictions, and whether consultation, an expert report, or testimony is needed.
Contact AMR before transferring evidence so that an appropriate method can be coordinated. Do not email, text, or upload suspected CSAM through an ordinary website form or file-sharing link.
Preservation comes first
Avoid unnecessary changes to devices, accounts, files, or original exports while preservation is being planned. Retain existing source material and record how it was obtained. Device-specific handling should be coordinated with an examiner; the appropriate steps depend on the device, its state, available authority, and the evidence at issue.
Review Emergency Preservation Options
Questions attorneys often ask
Can you review an existing forensic report?
AMR can evaluate reported findings against the materials available. A report-only review may identify questions or limitations; a broader opinion may require underlying source evidence, examiner notes, or additional discovery.
Can deleted messages always be recovered?
No. Availability depends on the device, application, encryption, backups, retention, and subsequent activity. The examination documents what was available and the limits of the results.
Does an IP address or device timestamp prove who acted?
Those artifacts may provide useful context, but they do not independently establish identity, intent, authorization, or a legal conclusion. They must be evaluated with the full record and relevant technical limitations.
Can AMR provide a report and expert testimony?
When included in the agreed scope, AMR can provide documented findings, explain the methodology and limitations, and support counsel through consultation, reporting, or testimony.
Attorney feedback
“There was a tremendous amount of data that needed to be analyzed in a short period of time. Mr. Rivera and his team totally exceeded my expectations.”
—David A. Evers, Attorney At Law
Read more attorney testimonials. Testimonials describe individual experiences and do not guarantee a result in another matter.
Discuss your matter confidentially
Speak with the AMR team about the evidence available, technical questions, deadlines, and an appropriate scope of work. Engagements are subject to conflict review, lawful evidence access, and an agreed scope. AMR provides forensic analysis, not legal advice.
