Questions, answered straight.

I find out what a device, an account, or a recording can actually prove, and then I explain it so a judge and jury can follow. That means acquiring the evidence properly, analyzing it with tested methods, documenting every step so the chain of custody holds, and writing a report that survives the other side’s expert. Sometimes the most valuable thing I tell a client is what the evidence does not show.

Earlier than most attorneys do. If I’m involved before the preservation letters and discovery requests go out, I can tell you what to ask for, in what format, and what the other side is probably sitting on. Brought in after the opposing report lands, I can still help, but some doors may already be shut. Logs rotate. Phones get replaced. Cloud data runs on retention clocks that don’t care about your scheduling order.

I work civil and criminal matters, and I worked inside the Rhode Island Office of the Attorney General before moving into consulting. Who retains me doesn’t change the work. The data says what it says, and my report will say the same thing no matter whose name is on the engagement letter.

Yes, and it’s some of the most useful work I do. Forensic reports often carry more certainty than the underlying data can support: a tool’s default output presented as a finding, a timestamp read without its time zone, a gap in the record treated as proof of deletion. I read the report adversarially, line by line, then test its claims against the evidence itself whenever it’s produced.

Yes to both. I’ve been qualified as an expert in state and federal courts since 2007, beginning in Rhode Island Superior Court, across more than 100 expert matters. I write expert reports and affidavits that meet Rule 26, and I write them for the judge who has to understand them, not just for the examiner across the aisle. My CV and testimony history are available to counsel on request.

Yes. I’m listed with the Massachusetts Committee for Public Counsel Services as a digital video and audio forensics expert. If you’re appointed counsel with a recording at the center of your case, call me.

Sometimes. Whether deleted messages survive depends on the phone, the operating system, the app, how much time has passed, and how heavily the phone has been used since. Modern phones encrypt aggressively and tidy up after themselves, so “deleted” increasingly means gone. But a conversation rarely lives in one place. It may sit in a cloud backup, on a paired computer or tablet, or on the other person’s phone, so the better question is where else it might exist. I’ll tell you what’s realistic before you spend money finding out.

A screenshot is a picture of a claim. It’s trivial to fake and hard to authenticate on its own, which is why I go back to the source whenever I can: the phone, the account, the backup, the metadata. Messages pulled from the device or account itself can be tied to times, contacts, and threads in ways a screenshot never can. If the source is gone, I’ll examine what remains and be plain about what it does and doesn’t establish.

Often, though not always, and I won’t pretend otherwise. Authentication examines a file’s structure, metadata, encoding history, and content for signs of editing, re-encoding, or synthesis, and compares it against what the claimed recording device would actually produce. The flip side now matters just as much. Once anything can be faked, people start calling real recordings fake. There’s a name for that: the liar’s dividend. Proving that authentic video is authentic has become its own kind of work.

Stop changing it. Don’t reset the phone, don’t “clean up” the computer, and don’t let anyone scroll through a device hunting for the good parts, because each of those actions overwrites something. Security camera systems often record over themselves within days or weeks, so get footage exported now. For email and cloud accounts, have counsel send preservation notices before routine retention quietly deletes what you need. Then call me, before anyone plugs the device into anything.

Often more than people expect. Infotainment and telematics systems can hold paired phones, call logs, contacts, navigation history, and sometimes location data, while event data recorders capture what the vehicle was doing around a crash. What’s recoverable varies a great deal by make, model, and year, so step one is finding out what that particular vehicle stores and what can be extracted from it.

I can follow the money on the chain. Most blockchains are public ledgers, so transactions between wallets can be traced, clustered, and mapped into a fund-flow analysis. What the blockchain usually won’t give you is a name. That link tends to come from exchange and custodial account records obtained through legal process, which is where tracing turns into evidence a court can use.

Don’t wipe or rebuild anything yet. The instinct is to make it go away, but rebuilding destroys the very evidence that tells you how they got in, what they took, and whether they’re still there. Isolate affected systems from the network rather than powering them off. Preserve your logs. In cloud environments, document the attacker’s footprint before you tear it down. Then call your attorney, your cyber insurance carrier, and me. For an active incident I’m available 24/7; use the Reveal Direct Contact button on the contact section.

Often, yes, and it’s worth deciding before the first report gets written. I’m not a lawyer, so take this one to yours, but engagements structured through outside counsel can help protect privileged analysis, and reports written for an operational audience have a way of turning up in discovery. Either way, I write every incident response report as though it will be read in court someday. It’s the only safe assumption.

Yes. Cloud compromises are a different animal. There’s often no disk to image; attackers work through the control plane with stolen credentials, and the evidence lives in audit logs, billing records, and configuration history that can expire or be deleted. I investigate account takeover, credential abuse, hostile infrastructure, and configuration tampering, and I preserve the cloud-side evidence before it ages out.

Yes, but read your policy first, or have counsel read it. Many cyber policies require prompt notice to the carrier and use of vendors from an approved panel, and stepping outside that process can put your coverage at risk. Call the carrier’s hotline before you hire anyone. Yes, including me.

A tabletop exercise is a rehearsal for a bad day. Your leadership team works through a realistic incident, decision by decision, and finds the gaps in the plan while the stakes are still imaginary. If you’re regulated under NYDFS Part 500, DORA, or NIS2, testing your response may already be a requirement rather than a good idea; I covered that in a Reversec whitepaper. Even where nobody requires it, an exercise is the cheapest place to discover that your plan depends on someone who left the company two years ago.

A virtual CISO is a part-time security leader: someone who owns your security strategy, reports to leadership, and keeps the program moving, without the cost of a full-time executive. It suits organizations that have outgrown “the IT person handles it” but can’t justify, or can’t find, a full-time CISO. Small firms, nonprofits, and regulated businesses that need someone accountable are the usual fit.

I’ll tell you what I’ve tested. I won’t recommend any tool I haven’t personally put through adversarial conditions, because a product that shines in a sales demo can fold the first time someone is genuinely trying to beat it. Demos are not evidence.

It depends on the size and shape of the work. Enterprise engagements that need the backing of a global firm, like large advisory programs, regulated-industry compliance, and multi-stakeholder crisis exercises, belong at Reversec. Expert witness and forensic matters, independent litigation support, and work with smaller organizations and nonprofits start with Suls & Co. Not sure? Ask me, and I’ll point you to the right door.

I’m based in Johnston, Rhode Island, just west of Providence, and I serve state and federal courts. Southern New England is home turf, but plenty of my work comes from farther away, and most of the analysis doesn’t depend on where I’m sitting. Acquisitions and testimony happen wherever they need to.

Forensic and expert work is billed hourly, and testimony and report writing bill at a separate rate from examination work. Scope drives cost more than the rate does: how many devices, how much data, how many questions need answering. We’ll talk scope before anything starts. Ask and I’ll send current rates.

For active incidents and urgent matters, I’m available 24/7. Everything else gets a response within one business day, and regular hours are Monday through Friday, 9 AM to 6 PM Eastern. If you’re up against a deadline, say so in your first message.

Reach out either way and tell me what’s going on. If your situation is headed toward a courtroom (harassment, impersonation, a contested divorce, a fight over messages or recordings), bring a lawyer in early. How evidence is collected matters as much as what it shows, and a lawyer can make sure the work is set up to be usable when it counts.

Yes. I’ve spoken at security conferences in the U.S. and Europe, including Disobey, BSides, Blue Team Con, and Mobile World Congress, and I teach continuing legal education sessions on digital evidence for attorneys. Topics run from how forensics really works in litigation to crisis exercises and adversarial AI. Invite me and tell me who’s in the room.