Texas DPS PSB Licensed
Licensed & bonded Private Investigations Company (#A1702) under Texas Occupations Code Ch. 1702.
FRE 902(13)/(14) Certified
Self-authenticating electronic records with dual-hash cryptographic verification (MD5 & SHA-256).
20+ Years Lab Casework
Two decades of expert witness testimony in Texas state and federal courts (Southern District of Texas).
Proprietary Forensic Suites
Powered by in-house IPTheft™ v1.0.6, EImager™, and Baylexx™ deep-carving engines.
Defensible Digital Forensics & Litigation Support
Every digital examination conducted by E-Investigations adheres strictly to NIST SP 800-86 standards and the Daubert framework, guaranteeing that recovered digital evidence withstands rigorous judicial scrutiny.
📱 Cell Phone Forensics & Deleted Message Carving (Baylexx™)
How Do We Recover Deleted Texts & Prove Spoliation? Court-admissible cell phone forensics requires physical and advanced logical acquisitions that preserve chain of custody under FRE 902(14). At E-Investigations, Principal Examiner Gary Huestis utilizes proprietary Baylexx™ unallocated space SQLite carving (sms.db, chat.db) to recover deleted SMS, iMessage, WhatsApp, and Signal communications with cryptographic SHA-256 hash verification.
- iOS & Android Deep Acquisition: Physical and advanced logical extractions plus isolated lab staging recovery.
- Deleted SQLite Database Carving: Recovery of deleted records from write-ahead log (
.wal) frames and unallocated database pages. - Monotonic ROWID Spoliation Proof: Identifying intentional message deletion gaps under Federal Rule of Civil Procedure 37(e).
- Encrypted App Telemetry: WhatsApp, Signal, Telegram, WeChat, call records, and precise geotagged metadata.
💻 Corporate Fraud, Departing Employee IP Theft & IPTheft™ v1.0.6
How Do We Prove Departing Employee Data Theft in 60 Seconds? Powered by E-Investigations’ proprietary IPTheft™ v1.0.6 engine, Principal Examiner Gary Huestis executes 60-second executive triage and 20-minute deep forensic scans directly on .E01 images—correlating 123 columns of USB/Mobile provenance, 5-layer Shift+Delete/Recycle Bin recovery, SRUDB.dat upload spikes, and a 7-Domain Employee Misconduct Scorecard (0–100) with [EXC-001]–[EXC-008] false-positive protection.
- 123-Column USB & Cloud Exfiltration Proof: Satisfying Texas In re Weekley Homes standards even when the thumb drive is missing, plus
SRUDB.datcloud upload telemetry (>50 MiB). - 5-Layer Shift+Delete & Wiper Recovery: Unallocated
$MFTresident$Ixxxxxxcarving,$UsnJrnl:$Jmass-deletion bursts, and Dual-Pass Registry (.LOG1/.LOG2) unioning. - 7-Domain Misconduct Scorecard (
0–100): IP Theft, Competitor Lift-Outs, PDF Invoice Forgery/QuickBooks Fraud, 96-Bucket Remote Time-Theft/Mouse Jigglers, Deleted Teams/Slack Chats, and FMLA Wi-Fi Location Audits.
🏛️ Digital Forensics Expert Witness Testimony
What Makes Digital Evidence Admissible Under FRE 702 & Daubert? Digital forensics expert witness testimony requires Daubert-defensible methodologies meeting Federal Rule of Evidence 702 and the Texas Robinson standard. Gary Huestis delivers Rule 26 expert disclosures, emergency TUTSA/DTSA TRO declarations, and courtroom cross-examination testimony grounded in over 20 years of forensic laboratory casework.
- Federal & State Court Qualification: Extensive testimony record in Harris County District Courts and the U.S. District Court for the Southern District of Texas.
- 48-Hour Emergency TRO Declarations: Rapid
.DOCXand.PDFprovenance exhibits for TUTSA, DTSA, and Non-Compete injunctions. - Spoliation Sanction Motions: Supporting motions for adverse inference instructions under FRCP 37(e)(2) and Tex. R. Civ. P. 215.2.
- Rebuttal Expert Evaluation: Exposing false positives in opposing reports via automated
[EXC-001]–[EXC-008]verification.
🔒 Forensic Bit-Stream Imaging & Write-Blocking (EImager™)
Why Is Hardware Write-Blocked Bit-Stream Imaging Required? Forensic bit-stream imaging creates an exact bit-for-bit physical clone of hard drives, NVMe SSDs, servers, and RAID arrays without altering source media. Utilizing hardware write-blockers (Tableau, Atola TaskForce) and EImager™ 4-tier provenance logging, E-Investigations preserves bit-level unallocated space, slack space, and Master File Tables ($MFT) with strict chain-of-custody documentation.
- Non-Destructive Physical Acquisition: Hardware write-blocking guarantees zero modification to underlying evidence sectors.
- Dual-Hash Cryptographic Verification: Simultaneous calculation of MD5, SHA-1, and SHA-256 hashes verifying bit-level integrity under FRE 902(14).
- Multi-Drive Host Correlation: Binding primary OS drives (
EV-001-A) to secondary NVMe/SD data volumes (EV-001-B/C). - Evidence Vault Custody: Tamper-evident physical evidence storage compliant with criminal and civil chain-of-custody protocols.
Do NOT turn on the laptop, open File Explorer, or let internal IT run scripts—booting Windows overwrites unallocated
$MFT deletion records and flushes Registry .LOG1/.LOG2 transaction logs.
Air-Gapped Faraday Lab • Written Chain of Custody
100% Banking, Financial & Personal Privacy Guarantee
When you entrust a personal smartphone, executive laptop, or corporate server to E-Investigations, your private financial accounts and unrelated personal life remain strictly protected under Texas statutory law and our four-pillar laboratory privacy protocol:
Your mobile banking, Zelle, Venmo, Cash App, investment portfolios, medical portals, and unrelated private photos are never touched, opened, or extracted unless explicitly requested in your written scope.
All examinations occur on air-gapped, offline laboratory workstations with hardware write-blocking and RF Faraday shielding—zero third-party cloud uploads or external exposure.
Licensed, bonded, and regulated by the Texas Department of Public Safety Private Security Board under Tex. Occ. Code Chapter 1702 with statutory client privilege protections.
Every device receives a signed physical Chain-of-Custody receipt upon intake and dual MD5/SHA-256 cryptographic hash verification upon completion.
As Seen On Television: KHOU 11, FOX 26 & CBS News
When major Texas television networks investigate government data leaks, smartphone deletion recovery, iPhone encryption, and covert spyware, they turn to Principal Forensic Examiner Gary Huestis inside the E-Investigations laboratory.
Crucial Texas Legal Notice: Texas Occupations Code Chapter 1702
Under Texas law (Tex. Occ. Code § 1702.104), performing digital forensics or recovering computer or mobile data for use in legal proceedings or civil disputes within the State of Texas requires a licensed Private Investigations Company credentialed by the Texas Department of Public Safety (DPS) Private Security Board (PSB). Unlicensed IT consultants risk having their evidence ruled inadmissible in court. E-Investigations is fully licensed (#A1702), insured, and bonded under the Texas DPS PSB.
Initiate a Confidential Forensic Examination
Whether preserving critical cell phone or laptop evidence for an emergency TRO, running a 60-second IPTheft™ departing-employee triage audit, or preparing Rule 26 expert disclosures, speak directly with lead examiner Gary Huestis.
📍 Houston, Texas Digital Forensics Laboratory:
On-site corporate & law firm imaging, insured courier & scheduled intake by appointment.