Frederick Data Forensics accepts devices, accounts, records, credentials, and data only from the owner or a person with documented legal authority to authorize the requested work.

Possession of a device, knowledge of a password, a family relationship, an employment relationship, or concern about another person does not automatically establish authority to access private information.

Before work begins, the customer may be asked to provide:

• Proof of identity

• Proof of ownership or lawful possession

• Written authorization from the owner

• Documentation of authority to act for another person or organization

• Identification of the specific device, account, records, or information involved

• A description of the requested service and authorized scope

The authorized scope identifies what Frederick Data Forensics may access, examine, preserve, recover, document, or modify. Examination is limited to what is reasonably necessary to perform the agreed service.

Finding unrelated information does not automatically expand the scope of the examination. Additional access, analysis, preservation, or remediation requires appropriate authority and may require an amended written agreement.

Access to customer case information is restricted to specifically authorized examiner accounts. Guest access, unnecessary user access, and access by unrelated personal accounts are disabled, denied, or otherwise restricted where applicable.

Strong, unique credentials and multifactor authentication are used for business systems where supported and appropriate. Access rights are assigned according to operational need rather than convenience.

Frederick Data Forensics does not intentionally search for unrelated personal information or use customer content for advertising, demonstrations, training, personal purposes, or unrelated analysis.

Forensic images, controlled working copies, recovered files, examination artifacts, and case documentation may be stored within access-controlled, encrypted areas on locally controlled business storage.

Customer case storage is separated from ordinary personal storage and unrelated business files. Encryption credentials and recovery information are protected separately from the encrypted customer data whenever practical.

Encrypted storage areas may remain locked after the storage system restarts until an authorized person deliberately unlocks them. This reduces the likelihood that stored case information becomes automatically accessible merely because the system is powered on.

Safeguards may include:

• Encryption of designated customer-data storage

• Separate authorized examiner accounts

• Strong, unique account credentials

• Multifactor authentication where supported

• Restricted shared-folder permissions

• Disabled guest and unnecessary account access

• Separation of encryption credentials from encrypted data

• Physical control of the storage equipment

• Logging or review of relevant administrative activity where available

• Defined retention and deletion procedures

Encryption primarily protects stored data when the applicable storage area is locked or the underlying media is unavailable to an authorized session. It does not eliminate every possible risk and does not replace:

• Strong account security

• Physical protection

• Access restrictions

• System updates

• Malware protection

• Integrity verification

• Appropriate backups or protected snapshots

• Documented handling procedures

• Timely deletion and media sanitization

The storage configuration and safeguards used for a particular matter may depend on the type, sensitivity, size, and authorized purpose of the customer information involved.

Customer information is organized according to its purpose and role within the engagement. Protected storage areas may be used to separate:

• Intake and customer-authorization records

• Device-receipt and chain-of-custody documentation

• Preserved forensic images

• Controlled working copies

• Examiner-generated working files

• Temporary exports and examination artifacts

• Potentially recovered customer files

• Data prepared for customer delivery

• Reports and case summaries

• Administrative, billing, and case-closure records

Separating these materials helps:

• Distinguish preserved source information from examiner-generated files

• Reduce the possibility of accidental alteration

• Prevent recovery output from being confused with original data

• Limit access to information that is necessary for a particular task

• Reduce the possibility of mixing information from different customers

• Apply the appropriate retention and deletion procedure to each category

• Document which materials were received, created, examined, or delivered

Each matter is assigned a case or intake identifier. Devices, image files, working materials, folders, documentation, and deliverables are labeled or associated with that identifier where appropriate.

Source media is treated as distinct from destination storage. Recovered files, reports, temporary exports, and other examiner-generated content are not intentionally written back to the original customer device.

Separation of case materials is an organizational and technical safeguard. It does not replace encryption, access controls, integrity verification, physical security, documented authorization, or appropriate retention procedures.

The customer’s device is treated as the source. Recovery output, examiner-generated files, reports, and other working materials are directed to separately identified destination storage and are not intentionally written back to the original media.

When the device type, interface, and condition support an appropriate protected connection, the source is connected through a hardware write-blocker. A hardware write-blocker allows the forensic workstation to read compatible media while helping prevent the computer or operating system from writing changes to it.

Before substantive access, Frederick Data Forensics may verify that:

• The customer device is correctly identified as the source

• Destination storage is separately identified

• The source and destination have not been reversed

• The intended write-blocked or protected connection is in place

• The write-blocker reports the expected read-only condition

• Recovery output will not be written to the source

• Automatic operating-system actions are limited or disabled where appropriate

When practical, a forensic image or controlled working copy is created before extensive recovery analysis. Examination is then performed from that image or copy, reducing repeated interaction with the original device.

Frederick Data Forensics does not intentionally initialize, format, repartition, defragment, or restore recovered files to the original media as part of the standard protected workflow. Automatic-repair utilities such as CHKDSK are not intentionally run against the original device during standard evaluation because they may alter file-system structures.

Not every device can use the same write-blocking or acquisition method. USB devices, proprietary enclosures, encrypted media, damaged interfaces, mobile devices, and certain specialized storage technologies may require different procedures. Any material departure from the standard protected workflow must be technically appropriate, documented, and authorized.

If the device becomes unstable or exhibits signs of physical failure, work may be paused or stopped to reduce the risk of additional damage.

Frederick Data Forensics may use cryptographic hashes and file-system integrity protections to help detect unintended changes or corruption affecting case materials.

These safeguards serve related but different purposes.

Cryptographic Hashes

A cryptographic hash functions as a digital fingerprint calculated from the content of a specific forensic image, file, export, delivery package, or other case material.

When independently calculated values match, that result helps demonstrate that the compared information remained unchanged between those calculations.

Depending on the engagement, hash documentation may include:

• The item or acquisition being hashed

• The selected cryptographic algorithm

• Hash values calculated during acquisition

• Verification values calculated after acquisition

• Hashes for recovered or exported files

• Hashes for reports or delivery packages

• Documentation of a mismatch or verification limitation

Commonly used algorithms may include SHA-256 or another technically appropriate cryptographic-hash algorithm.

File-System Integrity Protections

Protected business storage may use file-system checksums or related integrity features to help detect unintended storage corruption.

File-system checksums are intended to help identify integrity problems within the storage system. Forensic hashes document consistency for particular images, files, exports, or deliverables. Neither is treated as a replacement for the other.

Matching hash values or successful checksum verification do not establish that:

• Every sector of a damaged source device was readable

• Every original file was captured

• A recovered file is complete or usable

• The underlying information is accurate or truthful

• The original device was free from preexisting damage

• Every form of alteration, corruption, or loss is impossible

Any material read errors, verification failures, inaccessible areas, or integrity limitations identified during the work may be documented in the applicable case records or customer summary.

Limited-duration protected snapshots may be used on designated customer-data storage to help protect active case materials against accidental deletion, unintended modification, or certain disruptive events.

A snapshot preserves a point-in-time state of information stored within the applicable protected location. If an active file is accidentally changed or deleted, an authorized examiner may be able to recover an earlier version while the relevant snapshot remains available.

Protected snapshots may provide safeguards against:

• Accidental file deletion

• Unintended modification

• Certain forms of file-system corruption

• Some disruptive or malicious activity affecting active files

• Mistakes made while organizing or processing case materials

• Loss of an active working copy during the permitted snapshot period

Designated snapshots may be configured as immutable during their protection period. This means that the protected snapshot cannot ordinarily be manually altered or deleted before its configured expiration time, even if the corresponding active file is removed.

Snapshots are maintained for a limited operational period rather than indefinitely. They are not used to retain customer content for advertising, demonstrations, training, personal use, or unrelated analysis.

A snapshot is not a substitute for:

• A properly created forensic image

• Cryptographic-hash verification

• Secure customer delivery

• An independent customer backup

• Appropriate access controls

• A legally required preservation copy

• Long-term archival storage when separately authorized

Because a protected snapshot may temporarily retain an earlier copy after the active file has been deleted, snapshot expiration is considered separately from removal of customer information from active storage. The applicable timing is explained in the Customer-Data Retention and Removal From Active Storage sections.

Because active customer data is ordinarily retained for seven days after delivery and a protected snapshot may persist for up to seven additional days, the practical maximum customer-content retention period may be approximately 14 days after delivery.

Unless the customer authorizes a different period or continued preservation is required by the service agreement, an active dispute, legal process, reporting obligation, litigation hold, insurance requirement, or applicable law, active customer case data is ordinarily retained for seven calendar days after the recovered data and final deliverables are made available to the customer.

Depending on the work performed, customer case data may include:

• Forensic images

• Controlled working copies

• Recovered files

• Temporary exports

• Examination artifacts

• Case-specific notes containing customer content

• Copies prepared for delivery

• Other working information created for the authorized service

The seven-day active review period allows the customer to:

• Receive and access the delivered information

• Confirm that the destination media or delivery method functions properly

• Review recovered files

• Identify an apparent delivery problem

• Request clarification about the completed service

• Create an independent backup of the delivered information

Customers should review their deliverables promptly and notify Frederick Data Forensics of an apparent delivery problem before the active retention period expires.

The customer is responsible for maintaining the delivered copy after confirming receipt. Frederick Data Forensics should not be treated as the customer’s continuing backup, archive, records custodian, or long-term storage provider unless a separate written agreement expressly establishes that service.

After the applicable active retention period expires, reproducing the results may require the original device or records to be submitted and processed again. Reproduction may not be possible if the original media has changed, degraded, failed, been overwritten, or is no longer available.

A longer retention period is not automatic. When additional preservation is requested or required, the scope, purpose, duration, storage requirements, access restrictions, and any associated fees should be documented separately.

Active retention and snapshot retention are different periods.

The ordinary seven-day customer review period applies to information maintained in active case storage. After that period, customer content is removed from active storage.

An encrypted protected snapshot may temporarily retain an earlier copy for up to seven additional days before automatic expiration. The practical maximum customer-content retention period may therefore be approximately 14 days after the recovered data and final deliverables are made available to the customer. 

The possible snapshot period does not extend the ordinary customer review period. Customers should review, verify, and independently back up their delivered information during the initial seven-day active-retention period.

Additional details appear in the Protected Snapshots, Removal From Active Storage and Snapshot Expiration, and What Deletion Means sections.

After the applicable active retention period ends, customer case data is removed from active business storage unless continued retention has been separately authorized or is required by an active dispute, service agreement, preservation obligation, legal process, reporting requirement, insurance matter, or applicable law.

Information removed from active storage may include:

• Forensic images

• Controlled working copies

• Recovered files

• Temporary exports

• Examination artifacts

• Case-specific notes containing customer content

• Copies prepared for delivery

• Other customer-content working files

Removal from active storage does not necessarily mean that every underlying physical storage sector is immediately overwritten. An earlier encrypted copy may also remain temporarily available within a protected snapshot until that snapshot reaches its configured expiration.

Current designated customer-data snapshots are configured to expire automatically after no more than seven days. Under the ordinary retention process:

• Active customer case data is retained for seven calendar days after the recovered data and final deliverables are made available to the customer 

• Active copies are removed when that review period expires

• An encrypted snapshot may temporarily retain an earlier protected copy for up to seven additional days

• The practical maximum customer-content retention period may therefore be approximately 14 days after the recovered data and final deliverables are made available to the customer 

• Snapshot data is not intentionally retained to extend a customer’s case

• Once the applicable snapshot expires, the information is no longer available through active case storage or retained snapshots

Recovered customer content is not intentionally retained after the applicable period for advertising, demonstrations, training, personal use, product development, or unrelated analysis.

A longer period may apply when authorized by the customer or required by the service agreement, an active dispute, evidence-preservation requirement, litigation hold, legal process, insurance requirement, reporting obligation, or applicable law.

Administrative records that do not contain unnecessary copies of recovered customer content may be retained separately according to legitimate business, tax, insurance, contractual, or legal requirements.

Frederick Data Forensics ordinarily retains active customer case data for seven calendar days after recovered information and final deliverables are made available to the customer.

After that seven-day review period, customer content is removed from active business storage unless a different period has been authorized or continued preservation is required.

An encrypted protected snapshot may temporarily retain an earlier copy after the active version has been deleted. Current designated customer-data snapshots are configured to expire automatically after no more than seven days.

This means that under the ordinary retention process:

• Customer content remains in active storage for seven calendar days after the recovered data and final deliverables are made available to the customer 

• The active copy is removed when that review period expires

• An earlier encrypted snapshot may remain temporarily available for up to seven additional days

• The practical maximum retention period may therefore be approximately 14 days after the recovered data and final deliverables are made available to the customer 

• Once the applicable snapshot expires, the customer content is no longer available through active case storage or retained snapshots

The additional snapshot period is not intended as additional customer-access time or as an extension of the engagement. It exists temporarily because protected snapshots cannot ordinarily be altered or prematurely deleted during their configured protection period.

What deletion does—and does not—mean

Deletion removes customer case data from normal active access and, after the applicable snapshot expires, from available snapshot recovery.

Modern file systems, redundant storage arrays, solid-state drives, and copy-on-write storage technologies do not necessarily overwrite every underlying physical storage location immediately when an individual file is deleted.

For that reason, Frederick Data Forensics does not describe routine deletion of an individual customer case as:

• Immediate physical destruction

• Guaranteed sector-by-sector erasure

• Immediate overwriting of every underlying data block

• Proof that no residual representation could exist anywhere within the physical storage media

Instead, customer information is protected through layered safeguards:

• Customer case data is stored within designated encrypted storage areas

• Access is restricted to authorized accounts

• Encryption credentials are protected separately where practical

• Customer content is removed from active storage after the stated review period

• Protected snapshots expire automatically according to their configured schedule

• Storage equipment remains within the controlled business environment

• Customer content is not intentionally reused for unrelated purposes

• Retired business media is sanitized or physically destroyed before disposal or release from company control

Routine case deletion and end-of-life media sanitization are different processes. Routine deletion concerns particular customer files and case materials stored on active business systems. End-of-life sanitization applies to an entire storage device when it is retired, replaced, repurposed, transferred, or released from company control.

A different retention period may apply when requested by the customer or required by the service agreement, an active dispute, evidence-preservation requirement, litigation hold, legal process, insurance requirement, reporting obligation, or applicable law.

Certain administrative and business records may be retained beyond the customer-content retention period when reasonably necessary for tax, accounting, insurance, contractual, legal, security, dispute-resolution, or professional-recordkeeping purposes.

These records may include:

• Signed service agreements

• Customer authorization and scope documentation

• Device-receipt and return records

• Chain-of-custody documentation

• Customer contact and identity-verification records

• Device manufacturer, model, serial number, and reported capacity

• Case or intake identifier

• Dates of receipt, service, delivery, and case closure

• Estimates, invoices, receipts, and payment records

• Customer approvals or material instructions

• Documentation of delivery and customer receipt

• General service summaries

• Records of referrals, declined work, or case closure

• Documentation required for insurance, tax, legal, or regulatory purposes

• Records of a complaint, dispute, preservation request, or legal hold

Administrative records are maintained separately from active recovery data whenever practical and are subject to appropriate access restrictions.

Frederick Data Forensics does not intentionally retain recovered customer files, forensic images, working copies, complete exports, private communications, or other unnecessary customer content merely because an administrative record is retained.

A final report or service summary may necessarily contain limited technical findings, device identifiers, dates, file references, hash values, or other information needed to document the work performed. Reports should include only the information reasonably necessary for the authorized service and legitimate recordkeeping purpose.

The retention period for administrative records may differ from the retention period for customer-content working data. Administrative records may be retained for the period reasonably necessary to satisfy applicable business, tax, insurance, contractual, dispute-resolution, or legal requirements.

If a preservation obligation, active dispute, insurance matter, subpoena, court order, or other legal process applies, relevant records may be retained until the applicable obligation has been resolved.

Administrative records are not used to recreate or maintain a continuing archive of recovered customer content.

Passwords, verification codes, recovery codes, encryption keys, and other credentials are highly sensitive and should not be submitted through the public consultation form, ordinary unencrypted email, text message, or unsolicited telephone communication.

Frederick Data Forensics will never ask a customer to disclose a password, verification code, recovery code, or financial credential merely to complete an initial consultation.

When a credential is legitimately necessary for authorized work—for example, to access customer-approved encrypted media—the need, purpose, and handling method will be established separately.

Credential-handling practices may include:

• Requesting only the credential necessary for the authorized service

• Using a separate, agreed method of exchange

• Limiting access to the authorized examiner

• Avoiding unnecessary copying or transcription

• Keeping credentials out of reports unless specifically required

• Separating a delivery password from the encrypted deliverable

• Removing retained credential copies when they are no longer necessary

• Recommending that temporary or shared credentials be changed after service

• Documenting material access or handling when appropriate

Customers should provide a temporary or service-specific credential when the applicable system permits it rather than disclose a primary password used across multiple accounts or services.

One-time verification codes should remain under the customer’s control whenever practical. Frederick Data Forensics does not need a customer’s financial-account PIN, payment-card PIN, Social Security number, or unrelated account credentials to perform ordinary data-recovery work.

For personal digital-safety and scam-response services, customers ordinarily enter and retain control of their own account passwords, authentication codes, and recovery information. Frederick Data Forensics does not remotely access customer devices or ask customers to install remote-control software.

No credential should be provided unless the customer understands why it is required, what system or data it permits access to, and how it relates to the documented authorized scope.

Recovered information is delivered on separately identified destination media or through another method documented and approved for the engagement. Recovered files are not intentionally restored to the original source device.

Three different storage roles may be involved:

• Source media: The customer’s original affected device submitted for evaluation or recovery

• Business working storage: Frederick Data Forensics storage used temporarily for imaging, examination, recovery, validation, or staging

• Delivery media: The device used to provide recovered information to the customer

Business working storage remains under Frederick Data Forensics’ control and is subject to the applicable encryption, access, retention, snapshot, and deletion procedures. It is not ordinarily transferred to the customer.

Frederick Data Forensics–Provided Delivery Media

A customer may purchase suitable delivery media through Frederick Data Forensics.

FDF-provided delivery media will ordinarily be newly purchased or specifically obtained for the customer’s engagement. It will be selected according to the expected capacity, interface, compatibility, and delivery requirements.

Frederick Data Forensics does not upsell delivery media or add a markup. Customers are charged only the actual purchase cost of the storage media, including applicable sales tax, plus actual shipping charges. The cost will be disclosed and approved before purchase. Purchase receipts will be retained with the engagement’s administrative records and made available to the customer upon request. 

The estimate or invoice should identify:

• The type and capacity of the delivery device

• The applicable media cost

• Any agreed preparation or encryption requirements, with no additional delivery-media preparation or encryption charge. 

• When ownership transfers to the customer

• Available manufacturer-warranty information

A delivery device provided for one customer is not reused to deliver another customer’s information.

Customer-Provided Delivery Media

A customer may provide destination media when it is approved for the engagement.

The customer must confirm that:

• The customer owns the device or has legal authority to provide it

• The device is being provided specifically for recovered-data delivery

• It contains no information that must be preserved

• Frederick Data Forensics is authorized to inspect, screen, erase, format, test, and prepare it

• Existing information on the device may be permanently lost

• The device has sufficient capacity and an appropriate supported interface

• The device may be rejected if it is unsafe, unreliable, incompatible, or otherwise unsuitable

Acceptance of customer-provided media does not guarantee its authenticity, condition, remaining service life, performance, or future reliability.

Required Security and Suitability Screening

Every customer-provided delivery device is subject to a required security and suitability screening before it is approved for use within the Frederick Data Forensics recovery environment.

A separate screening and preparation fee applies to customer-provided delivery media. Frederick Data Forensics will provide a written quote and obtain the customer’s approval of the fee before accepting the device for screening or preparation. 

Depending on the device, condition, and intended use, the screening may include:

• Exterior and connector inspection

• Confirmation of reported device identity and capacity

• Review of partition and file-system information

• Identification of unexpected existing content

• Screening accessible content for recognized malicious or suspicious files

• Review for unexpected executable files, scripts, shortcut files, autorun configurations, or other potentially unsafe content

• Basic device-health or reliability checks when supported

• Confirmation that the device can be appropriately prepared for delivery use

Customer-provided media is not treated as trusted merely because it is described as empty, new, unused, or previously scanned.

If recognized malicious or suspicious content, unexplained existing information, unexpected encryption, counterfeit capacity, device instability, physical damage, or another material concern is identified, Frederick Data Forensics may:

• Decline the device

• Isolate it from further use

• Stop the screening

• Request different destination media

• Offer a separately scoped examination when appropriate

Recognized suspicious or malicious content will not be intentionally deleted, altered, or remediated without appropriate authorization. Additional examination or remediation, if offered, requires a separately authorized scope and may involve additional fees.

The screening reduces operational risk but cannot guarantee that the device is free from every form of malware, malicious firmware, hidden content, hardware modification, defect, or future failure.

A customer who does not wish to pay the customer-provided-media screening and preparation fee may purchase suitable delivery media through Frederick Data Forensics at the disclosed price.

Delivery Preparation

Before delivery, Frederick Data Forensics and the customer may establish:

• Whether the delivery media is supplied by the customer or Frederick Data Forensics

• Required capacity and file-system compatibility

• Whether the deliverable should be encrypted

• How any delivery password or recovery key will be communicated

• Who is authorized to receive the information

• Whether identity or receipt confirmation is required

• The applicable customer review period

• The customer’s responsibility for creating an independent backup

When encryption is appropriate and agreed upon, the delivery media or delivery package may be encrypted. The corresponding password or recovery key should be communicated separately from the deliverable whenever practical.

Recovered-Content Considerations

Recovered information generally reflects content that existed on the original source media. Recovery and structural validation do not, by themselves, establish that every recovered file is complete, compatible, trustworthy, or free from malicious content.

Security screening of customer-provided delivery media is different from malware analysis of recovered customer files.

When the circumstances indicate a possible security incident, malware screening, suspicious-file review, quarantine decisions, or remediation involving recovered files must fall within the authorized scope. Such work should be performed on an appropriate working or delivery copy rather than the preserved source or forensic image whenever practical.

A malware scan or suspicious-file review may identify certain recognized indicators, but it cannot certify that every recovered file is safe. Any screening performed, material findings, and known limitations will be documented when relevant to the engagement.

Customer Review and Receipt

The customer should promptly:

• Confirm that the delivery device can be accessed

• Review the delivered information

• Report an apparent delivery problem

• Create at least one independent backup

• Avoid relying on the delivered device as the only remaining copy

These actions should be completed during the seven-day active customer-review period.

Delivery may be documented through a receipt, transfer record, case summary, or other confirmation identifying:

• The authorized recipient

• Delivery date

• Device manufacturer, model, serial number, and capacity when applicable

• Whether the media was FDF-provided or customer-provided

• Preparation or encryption performed

• General materials delivered

• Customer acknowledgment of receipt

End-of-life media sanitization applies when a Frederick Data Forensics–controlled storage device is retired, replaced, repurposed for a less-protected use, transferred out of company control, returned to a vendor, or prepared for disposal.

End-of-life sanitization applies to the storage device as a whole. It is different from routine deletion of an individual customer’s case data from active storage.

Before a business-controlled storage device leaves its protected role, Frederick Data Forensics will select a sanitization or destruction method appropriate to:

• The media type

• The device’s condition

• The sensitivity of the information previously stored

• Whether the device remains operational

• Whether the device will be reused, returned, recycled, or discarded

• Whether the company will retain physical control

• The capabilities and limitations of the applicable storage technology

Depending on the device and intended disposition, the method may include:

• Verified overwrite procedures for supported magnetic media

• Manufacturer-supported secure-erase or sanitize commands

• Cryptographic erasure when encryption was properly implemented and applicable keys can be securely destroyed

• Physical destruction when logical sanitization is unavailable, unreliable, unsuccessful, or inappropriate

• Documented transfer to an appropriate secure-media destruction provider

Solid-state drives, flash storage, redundant arrays, remapped sectors, damaged devices, and other modern storage technologies may not respond reliably to ordinary overwrite procedures. Formatting, deleting files, deleting partitions, emptying a recycle bin, or performing a factory reset is not automatically treated as verified sanitization.

The sanitization record may document:

• Device manufacturer, model, serial number, and capacity

• Media type

• Former business purpose

• Date of sanitization or destruction

• Selected method

• Tool, command, or service used

• Verification result when applicable

• Person performing or authorizing the action

• Final disposition

• Third-party destruction receipt or certificate when available

A device that cannot be appropriately sanitized should remain under controlled storage or be physically destroyed before leaving company control.

Customer-owned source media and customer-provided delivery media are not erased, destroyed, transferred, recycled, or disposed of as part of the business media-retirement process without separate documented customer authorization.

End-of-life sanitization reduces the risk of residual customer or business information remaining accessible after a storage device leaves service. No sanitization method should be described as eliminating every conceivable technical risk unless the applicable method and verification support that conclusion.

Customer confidentiality is fundamental to the service, but it is subject to applicable law, valid legal process, contractual obligations, and circumstances in which preservation or disclosure is legally required.

If information encountered during authorized work reasonably appears to create a reporting, preservation, safety, or disclosure obligation, Frederick Data Forensics may:

• Suspend or limit further examination

• Restrict access to the relevant material

• Preserve information necessary to avoid destruction or alteration

• Document the circumstances in which the material was encountered

• Avoid unnecessary continued viewing, copying, or distribution

• Seek advice from qualified legal counsel

• Notify an appropriate authority when required by applicable law

• Respond to a valid subpoena, court order, warrant, or other lawful process

• Take other actions reasonably necessary to comply with a legal obligation

Frederick Data Forensics does not independently determine criminal guilt, legal liability, identity, ownership, or intent. A technical observation may support concern without establishing that a crime occurred or identifying the person responsible.

Any preservation or disclosure should be limited to information reasonably necessary for the applicable legal or safety obligation. Unrelated customer information should not be intentionally disclosed merely because a limited reporting obligation exists.

When legally permitted and operationally appropriate, the customer may be informed that work has been suspended or that legal process affects the handling of the matter. Notice may be delayed or withheld when prohibited by law, legal process, safety considerations, or direction from qualified legal counsel.

A customer request, service agreement, or confidentiality expectation cannot require Frederick Data Forensics to conceal, destroy, alter, return, or disregard information when doing so would violate applicable law or a valid preservation obligation.

Nothing in this section means that Frederick Data Forensics conducts private-investigator work, determines whether conduct is criminal, provides legal advice, or routinely reports customer information to law enforcement.

The handling of suspected unlawful material, imminent safety concerns, subpoenas, preservation demands, and other legally sensitive matters will be governed by applicable law and the written service agreement.

Frederick Data Forensics applies a straightforward privacy principle:

Access only what is authorized and reasonably necessary. Protect the original media. Secure customer information during the work. Document material actions. Explain the results clearly. Retain customer content no longer than necessary.

In practice, this means:

• Confirming ownership or legal authority before examination

• Defining the authorized scope in writing

• Limiting access to authorized accounts

• Separating customer content from personal and unrelated business information

• Using encrypted business storage where applicable

• Protecting original media through appropriate write-blocking, imaging, and working-copy procedures

• Distinguishing preserved information from examiner-generated files

• Using integrity checks when appropriate

• Documenting material access, acquisition, recovery, remediation, and delivery actions

• Avoiding unnecessary collection, copying, viewing, or retention

• Explaining findings and limitations in language the customer can understand

• Removing active customer content after the applicable review period

• Allowing protected snapshots to expire according to their configured schedule

• Retaining only necessary administrative records

• Sanitizing or destroying retired business media before it leaves company control

• Limiting disclosure to what is authorized or legally required

No technical or administrative safeguard can eliminate every possible risk. Frederick Data Forensics uses layered controls and documented procedures intended to reduce risk, preserve integrity, and handle customer information responsibly throughout the engagement.

Questions about privacy, storage, delivery, retention, or authorized access should be resolved before sensitive information or a customer device is submitted for service.