Private investigators & DFIR consultants
Look like a lab on the paperwork, without a lab behind you.
A small shop is judged on its documentation long before anyone reads its analysis. Each acquisition and each delivery to a client or instructing attorney becomes a signed, dated record that the other side can verify without your help.
Licensed investigators, one- and two-person digital forensics shops, and independent examiners retained by counsel.
The problem
Where the custody record comes apart.
The paperwork is what gets attacked
The analysis may be sound. What draws fire on cross-examination is the spreadsheet recording when you took the device, where it sat overnight, and who had it after you did.
A form you designed yourself is a form you have to defend
A custody sheet built in a word processor is a document opposing counsel gets to characterise. A record an independent party can check is considerably harder to wave away.
Tooling assumes an organisation you do not have
Case-management suites with per-seat licensing and annual minimums are shaped around a team and a steady pipeline. Most consultancies are one to three people billing by the matter.
The people you deliver to have no process for receiving
The instructing attorney or corporate client at the far end of the handoff often has no way to acknowledge receipt formally. A signed transfer closes that end of the chain on their behalf.
Where it fits
Three points in work you already do.
Acquire
Record the device or account, the acquisition method, the write-blocker or unlock state, and the digest of the output — at the moment you take it, not in the report you write three weeks later.
Deliver
Transfer to the instructing attorney, the client, or a testifying expert. They confirm identity and sign, and you keep the acknowledgement in the same record as the acquisition.
Defend
In a declaration or on the stand, point to a chain that re-computes from its first entry, and to a verification anyone in the room can run for themselves.
The terms this record uses
- Acquisition hash
- Write-blocker
- Extraction method
- Instructing attorney
- Expert declaration
- Cross-examination
- Client deliverable
- Per-matter billing
What you can stand behind
Claims that survive being tested.
Independent verification is the credibility
The value is not that you kept a log — everyone says they kept a log. It is that a third party can check yours without your cooperation and without ever seeing the evidence.
The vocabulary examiners already use
Acquisition type, write-blocker status, unlock state, extraction method: the templates ask what an examiner records, informed by NIST SP 800-86 and ISO/IEC 27037 rather than borrowed from a generic asset-tracking form.
Precise about what it demonstrates
Records are tamper-evident: a change to any entry breaks verification for everything after it. It detects alteration rather than preventing it, and being able to say exactly that is what survives a good cross-examination.
No seats, no annual minimum
$4.99 per form, or a monthly plan when the caseload is steady. Transfers and verifications are unlimited and free, so nobody you hand off to is ever asked to pay or to sign up.
Start from the right form
The templates this work needs.
Weighted toward what a private investigation actually collects: a phone extraction, platform content and direct messages, and captured web pages.
Devices
Mobile device
The whole handset or tablet, not one app — IMEI, unlock state, and extraction depth.
Messaging apps
One Instagram account — DMs, posts, stories, or a full “Download Your Information” package.
Cloud & online
Website / web page
A public page or site as it stood at a moment in time — WARC, MHTML, or screenshots.
Messaging apps
Telegram
Telegram cloud chats and channels from a desktop export — or device-only secret chats.
All twelve templates are available on every plan — see the full set.
Common questions
- Do I need a subscription?
- No. Single forms are $4.99 and the credit does not expire. Monthly plans exist for a steady caseload, and every plan includes unlimited transfers and verifications.
- Can a client who has never heard of CustodyTrack accept a transfer?
- Yes. They receive a secure link, confirm their identity, and sign. No account, and no cost to them.
- What can I say about these records in a declaration?
- That the record is tamper-evident and independently verifiable: each entry is chained to the one before it, so alteration is detectable by anyone re-running the verification. Claims beyond that — about admissibility, or about any standards body having assessed the product — are not ones it supports.
What it costs
$4.99 per Authenticated Chain of Custody Form, or a monthly plan for regular volume. Transfers and verifications are unlimited and free on every plan, and the party receiving a transfer never pays anything.
Other work looks different? See the other three.
Make the paperwork the strongest part of the file.
Two forms free at signup, $4.99 each after that. No seats to buy and no annual contract to sign.