Digital forensics experts bill hourly, with testimony and deposition time at a higher rate than analysis. Cost is driven by scope rather than rate: the same expert on the same matter varies enormously depending on how many devices are imaged, how much data reaches review, and whether the engagement ends at a report or runs to trial.
What you are actually buying
An expert engagement is usually four separable things, and conflating them is where budgets go wrong:
- Acquisition — imaging the devices and establishing chain of custody. Largely mechanical, largely predictable, and priced close to the time it takes.
- Analysis — the examination itself. The widest variance, because it depends on what the data turns out to contain.
- Reporting — a written report that can withstand a Daubert challenge. Slower than clients expect, because every assertion has to be traceable to an artifact.
- Testimony — deposition and trial, plus the preparation each requires. Billed at a premium essentially everywhere.
A matter that stops after step 2 because the analysis resolved the question costs a fraction of one that runs to trial. That is often the single largest variable, and it is rarely knowable at the outset.
The variables that actually move the number
Device count and type. Imaging a laptop is routine. A modern phone with full-disk encryption, a cloud tenancy with several years of history, or a server array are each substantially more work — and phones vary enormously by model and OS version, because what can be extracted depends on the vendor's current security posture.
Data volume reaching review. This is where eDiscovery economics dominate forensic economics. Filtering, deduplication and targeted date ranges routinely remove most of a collection before human eyes are involved. The decisions that set that scope are made early and are worth spending time on.
How well-defined the question is. "Find out what happened" is an open-ended engagement. "Determine whether these fourteen files were copied to external media between March and June" is a bounded one. The second is not merely cheaper — it produces a clearer opinion, because a narrow question yields a narrow, defensible answer.
Urgency. Emergency preservation over a weekend, or a deadline that requires several examiners in parallel, costs more than the same work scheduled.
Opposition. A well-resourced opposing expert generates rebuttal work, supplemental analysis, and a longer deposition. This is genuinely outside anyone's control at the outset.
How to control it without undermining the work
- Phase the engagement. Authorise acquisition and a preliminary assessment first. A short scoping analysis frequently determines whether the full examination is worth commissioning — and occasionally shows the theory does not survive the data, which is the cheapest possible outcome.
- Preserve early, analyse later. Preservation is comparatively inexpensive and time-sensitive; analysis is expensive and can wait. Reversing that order costs more and sometimes loses evidence outright.
- Do not have counsel do it. Attorney time spent on data handling is billed at attorney rates to do work an examiner does faster, and it can make the attorney a witness to the collection.
- Ask for the assumptions behind the estimate. Any competent expert can tell you what their number assumes about device count, volume and scope. When the estimate moves later, you will know which assumption changed rather than arguing about the total.
What a fixed fee can and cannot cover
Acquisition and preservation can often be quoted flat, because the work is knowable in advance. Analysis rarely can, and a firm fixed fee for open-ended analysis usually means either a large risk premium or a scope so tightly drawn that the first surprise triggers a change order. Neither is dishonest, but both are worth recognising for what they are before signing.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.