Digital forensics
Mobile and computer acquisition, cloud and account artifacts, deleted data recovery, metadata and timestamp analysis, examiner reports suitable for filing.
We work with families and the attorneys they've already retained to preserve digital evidence, establish what actually happened, and build a case file the public can evaluate before deciding whether to fund it.
Device image acquired and hash verified sha256 4f2a...c81b · chain intact
VerifiedAccount access from a second location stated by participant · unconfirmed
AllegedReport timestamps conflict with file metadata 2 accounts · 41 min variance
DisputedDispatch logs requested, not yet produced req 08-14 · no response
PendingRecords go unrequested. Devices sit unexamined. Footage gets overwritten on a 30-day cycle while everyone waits for a court date. By the time it matters, it's gone.
Acquisition, hashing, and chain of custody, done to a standard that survives a Daubert challenge. Not a screenshot from someone's phone.
The mark attaches to a piece of evidence, never to a person and never to an outcome. This is the whole product.
A qualified examiner reviewed the underlying record, device, or artifact directly, under documented chain of custody, and the finding follows from that review. Verified means the examination happened and this is what it found. It does not mean the person is innocent, that a claim is legally proven, or that anyone did anything wrong.
A participant states it. It may be documented, consistent, and entirely true, but it has not been independently established by examination. Most of what anyone knows about any case sits here. Saying so out loud is the point.
Two accounts conflict on a material point, or the evidence is internally inconsistent. Disputed items get published with both accounts stated and neither one resolved. We do not quietly drop the version that hurts.
Everyone in this space is vague about their role. Being precise about ours is what makes a case file worth trusting.
Four stages. A matter can stop at any of them, and most do.
You describe the matter, who's involved, and what records or devices exist. No evidence changes hands at this stage.
We look for corroboration, contradictions, and gaps, and confirm counsel is retained. If the record won't support a public case, we say so.
Evidence is preserved and examined under chain of custody. Findings get classified, including the findings that hurt.
The case file goes live with itemized costs and a link to the family's own campaign, which they control end to end.
This is a structural choice, not a policy we could change later. It's the most important thing to understand about how this works.
The person in the case, or an immediate family member, is the organizer and named beneficiary on GoFundMe. They open it, control it, and withdraw from it.
Evidence index, written summary, itemized cost breakdown, update schedule. That material is what makes a campaign credible to a stranger.
Donor to platform to beneficiary. It never passes through Public Defend, and we take no percentage of it.
Contributions to an individual's case are personal gifts and are not tax deductible. Only contributions to a qualified 501(c)(3) are deductible, and money earmarked for a specific named individual doesn't qualify even when a charity is involved. If a page on this site ever says otherwise, it's wrong and we want to know.
Public Defend is not a charity, does not solicit charitable contributions on this website, and is not a registered charitable organization. Support links direct you to a third-party platform whose terms, fees, and refund policies govern your contribution.
Public Defend is not a law firm and does not provide legal advice, representation, or attorney referrals. Legal services, where they exist in a matter, come from independent counsel the client retains directly.
Examination is the product. Everything else on this site is downstream of it.
Mobile and computer acquisition, cloud and account artifacts, deleted data recovery, metadata and timestamp analysis, examiner reports suitable for filing.
Authentication of surveillance and body-worn footage, container and encoding review, frame-level examination, assessment of edits, gaps, or re-encoding.
Public records requests, dispatch and custody logs, medical and employment records, assembled into a single sourced chronology.
Licensed investigators for scene documentation, witness location and interviews, and evidence collection under the direction of your counsel.
Written declarations and, where required, testimony from examiners qualified to explain technical evidence to a court.
The public summary, evidence index, itemized budget, media kit, and update cadence a campaign needs to withstand scrutiny.
The person reviewing your evidence is a working forensic examiner who writes reports that get filed and testifies to them. That is a different job from arguing your case, and it is the reason a finding from this office means something to a court.
We are engaged under the direction of your counsel. When an examination contradicts the client's account, the finding still goes in the report.
Summary only. We'll tell you within five business days whether this is something we can examine, and we'll tell you plainly if it isn't.
We take a small number of matters. A case moves forward far more often when counsel is already retained and evidence still exists unaltered.
If evidence is at risk of being deleted, overwritten, or wiped, say that in your first line.