Evidence does not sit still, and neither do we. Whether the device is across town or across an ocean, whether there is one custodian or a hundred, Cyber Agents, Inc. conducts forensic collections wherever the evidence is and returns a defensible product every time.
We go where the evidence is
On-scene collection is exactly what it sounds like: one of our examiners travels to wherever the device or data source is located, conducts the collection in person, and maintains chain of custody through every step of the process. That might be a law firm conference room, a corporate office, a third-party evidence facility, a county jail, or a military installation overseas.
We have conducted on-scene collections at installations across the continental United States and at overseas locations including Germany, Korea, Japan, Okinawa, Italy, and Hawaii. We have appeared at third-party evidence facilities in Kansas, Pennsylvania, and other states to examine devices in their custody under chain-of-custody protocols. We have worked multi-day on-site examinations at locations where the volume of evidence required extended presence. We have traveled on short notice when litigation timelines demanded it. Responsiveness is not a service offering — it is how we operate.
When on-scene collection is required, we bring the equipment, document chain of custody, and limit handling to authorized personnel under the engagement’s collection protocol.
Remote collection when physical presence is not possible
Not every collection requires an examiner on-site. When a custodian is in a different jurisdiction, when a client cannot travel, or when time constraints make physical collection impractical, we have purpose-built solutions that allow us to conduct a forensically sound collection remotely.
Computers can be imaged remotely using tools that maintain the integrity of the collection process without requiring the device to leave its location. Mobile devices have remote acquisition pathways that, where technically available, produce the same caliber of extraction as a physical handoff. Cloud accounts and online platforms are collected remotely by definition — Microsoft 365, Google Workspace, iCloud, and major cloud storage providers are accessed directly through their compliance interfaces.
We walk attorneys and their clients through the remote collection process in plain terms. The technical complexity is on our side of the call.
One device or a hundred
Some matters require a single phone extraction from a single custodian. Others involve a company with dozens of employees, multiple office locations, and a mix of corporate and personal devices used for work.
We scale to the engagement. For multi-custodian collections, we coordinate the logistics, stage the workflow, and process devices efficiently so that the collection does not create a protracted disruption to the client’s operations. Our approach to large collections is the same as our approach to single-device matters: scoped, documented, and defensible.
Chain of custody regardless of collection method
Whether a collection happens on-scene or remotely, the chain of custody documentation is the same. The collection methodology is logged. The device condition at the time of collection is documented. The hash values that verify the collection’s integrity are recorded and provided with the work product.
A collection must be documented well enough for its methodology and chain of custody to be evaluated if challenged. Every engagement we conduct is built for the possibility that the collection methodology itself will be challenged — because in contested matters, it sometimes is.
What attorneys need to know
You need to know that we will respond promptly. When opposing counsel serves preservation requests or a court order drops with a short compliance window, the question is not whether we can do the work — it is whether we can be reached and mobilized in time. We can.
We have worked emergency collections on timelines that gave us hours rather than days. We have coordinated collections across multiple time zones simultaneously. The logistics are our problem. You should be spending your time on the case, not on figuring out how to get a forensic examiner to wherever the evidence is.
Collection types we handle
- Mobile device extraction on-site at any location in the continental United States and internationally
- Remote logical acquisition of computers and mobile devices when physical presence is not feasible
- Cloud account and platform collection from Microsoft 365, Google Workspace, iCloud, and major enterprise platforms
- Multi-custodian corporate collections requiring coordinated logistics across single or multiple locations
- Evidence facility and law enforcement property room collections under chain of custody
- International collections at military installations and overseas locations
Why it matters who does this
Collection errors cannot always be corrected after the fact. Like a chain of custody with a gap in it, everything after that point is in question — an improperly documented collection creates problems that do not stay contained to the collection itself. A device that was not properly hashed. A remote collection conducted with a tool that does not produce a forensically sound output. These are problems that surface at deposition or at trial, and they are much harder to address then than they were at the time of collection.
We collect correctly the first time. The methodology documentation exists. The chain of custody is intact. When the collection is challenged, the record answers the challenge.
Related services and litigation support
Contact Cyber Agents to discuss whether remote and on-scene collections fits your matter.