The state has a forensic examiner.
Your client should too.
Independent digital forensics for the defense in Colorado — including recovery of the damaged devices the state reported as unreadable. Reduced rates for indigent cases.
The defense doesn't get the evidence. It gets the state's version of it.
Digital evidence arrives looking objective. It rarely is — someone else chose what to export, how to label it, and which timestamps to trust. These are the six failure points that come up most often in Colorado criminal cases.
When a phone is water damaged, crushed, burned, or a drive won't spin, the state's lab reports that nothing could be extracted — and everyone treats that as the end of it. It usually isn't. Their examiners image devices; they don't repair them.
Cellebrite, GrayKey and AXIOM produce a full acquisition. What reaches you in Crim. P. 16 discovery is a report someone else generated from it, filtered by their search terms and their idea of what matters.
Logical extractions routinely pass over unallocated space, SQLite free pages and WAL journals — frequently the exact location of the deleted message, earlier draft, or removed photo that changes the story.
UTC versus local time, device timezone changes, DST, and app-specific epoch formats routinely move an event by hours. A timeline built on unconverted timestamps can place your client somewhere they weren't.
CSLI shows which tower sector carried a call, not where the phone was standing. Sector coverage shifts with terrain and network load. “Consistent with the area” is not “located at the scene,” and juries hear those as the same sentence.
Forensic tools label artifacts by app and account, not by human being. Shared devices, cloud sync from a second phone, and auto-downloaded media all arrive labeled as your client's activity with no attribution analysis behind it.
A Colorado lab that recovers the data first, then examines it
Most forensic examiners can only work with a device that still powers on. Denver Data Recovery has been a data recovery lab since long before it did forensics — a 97% success rate on media other labs return as unrecoverable. When the state's report says nothing could be extracted, that is frequently a statement about their tooling, not about the device.
Related capabilities: mobile device recovery, hard drive recovery, RAID and NAS recovery, and our general digital forensics services.
What we examine for the defense
Every examination is write-blocked, hashed, and documented for admissibility — whether it ends up in a suppression motion, a report, or on the stand.
- Cleanroom recovery from physically failed drives, phones, and flash media
- Board-level repair and chip-off extraction on devices declared unreadable
- Recovered data is imaged and hashed for examination, not just handed back as files
- Full file-system or physical extraction where the device and OS permit
- Messages, call logs, app data, media, location artifacts, deleted content
- Independent re-examination of the state's Cellebrite / GrayKey / AXIOM output
- User activity timelines, browser artifacts, file history, USB device history
- Analysis of what was actually accessed versus what merely existed on disk
- Recovery and carving from unallocated space and file-system journals
- Independent review of the state's mapping and its coverage assumptions
- Device-side location artifacts (Wi-Fi, GPS caches, app check-ins) for alibi work
- Plain-language explanation of what those records can and cannot establish
- Metadata and timestamp verification, re-encoding and edit detection
- Frame-level review, stabilization, and defensible enhancement
- Assessment of authenticity and provenance claims made by the other side
- Written reports and affidavits structured against CRE 702 / People v. Shreck
- Rebuttal analysis of the prosecution expert's methodology and conclusions
- Availability for motions hearings, depositions, and trial testimony
How an engagement actually runs
Built around indigent-defense realities: funding approval, filing deadlines, and a caseload that doesn't pause for a forensic examination.
Free scoping call
Tell us the charges, the devices, what the state produced in discovery, and your next court date. We tell you what is realistically recoverable and what it costs. No charge, no obligation.
Written estimate for your funding request
You get an itemized, scoped estimate suitable for an OSPD or ADC ancillary-services request, or a CJD 04-04 motion for court-paid expert fees — written to be read by an administrator or a judge, not by an engineer.
Recovery, then forensic imaging
Damaged media goes to the recovery lab first. Working media goes straight to imaging. Either way the evidence is write-blocked, hashed, and logged, and nothing is examined on the original.
Analysis and early interim findings
We work the image and call you as soon as we know whether there is something there. You hear it early enough to change strategy — not the week of trial.
Report and testimony
A written report in plain English with the technical exhibits behind it, and the examiner who did the work available to explain it under oath.
Built for Colorado indigent-defense caseloads
Where we work
Denver-based lab serving defenders across the Front Range and the Western Slope. Devices can be delivered, couriered, or shipped, and evidence stays in Colorado.
Not ready to call? Start here instead.
Two resources written for counsel rather than for examiners. Both are free, neither requires talking to us.
Forensic case studies
Worked examples: transcoded video played at trial, body-camera footage reported as nonexistent, a timestamp that moved an offense before the order it allegedly violated. Ends with twenty questions to ask about every digital exhibit.
Evidence terminology
Extraction levels, unallocated space, hashes, CSLI, audit logs, redaction logs — each defined plainly, then what it changes in a case and the question to ask because of it.
Questions defense counsel actually ask
Usually not. A forensics lab images devices; it does not repair them. We're a data recovery lab first — Class 100 / ISO-5 cleanroom, board-level repair, chip-off extraction — so a water-damaged, crushed, burned, or dead device that the state wrote off is often still readable. Once recovered, it's imaged and hashed for forensic examination like any other exhibit.
Generally yes. OSPD and ADC counsel request ancillary services through their office, and counsel appointed under CJD 04-04 can seek court-paid expert and investigator fees. What makes any of those requests easier to grant is a scoped, itemized written estimate rather than a placeholder number — we provide that at no cost before you file.
Because what you received in discovery is an export the state's examiner generated from a much larger acquisition. An independent review works from the full image: what was left out of that export, the deleted and unallocated data, whether timestamps were correctly converted, and whether the attribution in the report is actually supported by the artifacts underneath it.
Scoping call same day in most cases. Imaging typically begins within 24 to 48 hours of receiving the device. Analysis time depends on the device and the scope. If you're against a filing date, lead with the date — we schedule backward from it and will tell you honestly if it can't be met rather than take the case and miss it.
You hear it from us privately, and early. The engagement is with the defense, the findings are your work product, and nothing is disclosed by us to anyone. Learning a weakness before the prosecution raises it is often worth the examination by itself.
Yes, and the examiner who performed the work is the one who testifies to it. Reports are written to be defensible under cross and structured against the CRE 702 / People v. Shreck reliability framework Colorado courts apply, with the methodology and verification hashes documented rather than summarized.
Both. This page exists because appointed counsel are the ones most often working without a forensic examiner, but retained defense counsel and civil litigators use the same lab and the same process.
Tell us the case, the device, and the deadline
We'll tell you what's recoverable, what it costs at indigent-defense rates, and whether your date is achievable. The scoping call is free and there's no obligation.