1. Original devices
Original devices are returned to the Client (or the party who delivered them) at the end of an engagement, or earlier on request. If a device is not collected within ninety (90) days of notice, we may securely destroy or dispose of it after a final written notice.
2. Forensic images and working data
- Default retention: ninety (90) days after delivery of the final report.
- Active legal matters: retained for the duration of the matter plus the appeal period, then destroyed.
- Extended retention: available on written instruction from the Client, typically charged at a periodic storage fee.
3. Reports and case file
Final reports, chain-of-custody records and engagement correspondence are retained for seven (7) years to meet professional, insurance and regulatory obligations.
4. Destruction method
Digital data is destroyed using cryptographic erasure or NIST 800-88 compliant wiping. Physical media is degaussed or physically destroyed. A Certificate of Destruction is available on request.
5. Backups
Encrypted backups are rotated and overwritten on a defined cycle. Data deleted from primary storage is purged from backups within ninety (90) days.