📍 Houston, Texas Digital Forensic Laboratory • Serving Harris County, Greater Houston & Nationwide
🔒 24/7 Evidence Preservation Hotline: (713) 628-4408
NIST SP 800-86 & FRE 902(13)/(14) Compliant • In-House Forensic Software Engineering

Our Forensic Process & Proprietary Lab Technology (IPTheft™, EImager™ & Baylexx™)

Most digital forensics firms merely rent off-the-shelf software and bill clients by the hour while waiting on progress bars. At E-Investigations, Principal Examiner Gary Huestis engineers proprietary forensic acquisition, deep-carving, and timeline correlation suites—eliminating multi-hour indexing bottlenecks while enforcing strict courtroom reproducibility under FRE 702 (Daubert / Texas Robinson) and FRE 902(13)/(14).

What Is the E-Investigations Digital Forensics Process?

E-Investigations executes a 4-stage NIST SP 800-86 and EDRM-aligned forensic methodology: (1) Hardware write-blocked bit-stream imaging and 4-tier provenance binding via EImager™; (2) Zero-index-delay streaming analysis using IPTheft™ v1.0.6 (for Windows/corporate endpoints) and Baylexx™ (for iOS/mobile devices); (3) Cross-artifact corroboration paired with automated [EXC-001]–[EXC-008] exculpatory baseline verification; and (4) Synchronized 6-format courtroom deliverables authenticated via dual MD5/SHA-256 cryptographic hashes under Federal Rules of Evidence 902(13) and 902(14).

Three Proprietary Forensic Platforms Engineered by Gary Huestis

Every tool developed at E-Investigations parses documented operating system binary structures deterministically—reporting exact MFT record numbers, USN offsets, SQLite page offsets, and raw byte counts first so any opposing expert can independently verify every byte on the underlying evidence image:

Corporate & Endpoint Suite

1. IPTheft™ & IPTheftWorkbench™ v1.0.6

Built on .NET 10.0 x64 and our native C17 EImagerBridge.dll engine (libewf random-access chunk streaming, SQLite 3.51.2 -wal replay, Windows ESENT esent.dll dynamic page-size SRUDB.dat parsing, and kernel ntdll.dll Xpress Huffman MAM\x04 Prefetch decompression).

  • 60-Second Triage & 5–20 Min Phase 1 Deep Scan directly on .E01 images.
  • 123-Column USB & Mobile Provenance Matrix + 5-Layer Shift+Delete Recovery.
  • 7-Domain Employee Misconduct Scorecard (0–100) & [EXC-001]–[EXC-008] Exculpatory Badges.
Acquisition & Provenance Engine

2. EImager™ Acquisition & Sanitization Suite

Hardware-aligned bit-stream imaging and forensic media sanitization platform that establishes our strict 4-Tier Evidentiary Hierarchy from the moment of collection:

  • Level 1 (Case) → Level 2 (Custodian) → Level 3A (Parent Host EV-001) → Level 3B (Storage Sub-Items EV-001-A/B/C).
  • Auto-embeds PC Manufacturer, Model, Serial Number, Drive Slot, and MD5/SHA-1/SHA-256 digests into companion logs for zero-touch ingestion by IPTheft™.
  • Generates cryptographic Media Sanitization Certificates verifying zero cross-case contamination.
Mobile & SQLite Carving Suite

3. Baylexx™ iOS & Mobile Forensic Engine

Advanced mobile device extraction, isolated lab staging device recovery, and deep SQLite binary carving suite engineered for high-stakes civil and criminal litigation:

  • Carves deleted iMessages, SMS, WhatsApp, and Signal records from unallocated SQLite B-tree pages and Write-Ahead Logs (sms.db-wal).
  • Detects monotonic ROWID sequence gaps to prove intentional message deletion under FRCP 37(e).
  • Cross-matches iOS UDIDs and Info.plist/Manifest.plist backups directly with IPTheft™ workstation artifacts.

The 4-Stage E-Investigations Evidentiary Workflow

Stage 1: Chain-of-Custody Intake & Hardware Write-Blocked Bit-Stream Imaging

Every physical workstation, NVMe SSD, USB drive, server array, or mobile device received at our access-controlled Houston, Texas forensic laboratory or imaged on-site at counsel’s office is documented on a signed Chain of Custody ledger and acquired through physical hardware write-blockers (Tableau / Atola) and EImager™. Pre- and post-acquisition MD5, SHA-1, and SHA-256 hashes prove zero bytes were altered.

Stage 2: 60-Second Executive Triage & Single-Pass Deep Carving

Rather than billing for 12 hours of commercial indexing, we run IPTheft™ v1.0.6 directly against the .E01 image—evaluating all 7 corporate misconduct domains, reconstructing the 5-layer deleted file history, and correlating multi-drive hosts (EV-001-A + EV-001-B) in minutes.

Stage 3: Forensic Data Sizing Precision & Exculpatory Verification

To prevent unit ambiguity in court, every E-Investigations report outputs the exact raw byte count first followed by both SI (base-1000: KB, MB, GB, TB) and IEC (base-1024: KiB, MiB, GiB, TiB) calculations (e.g., 500,107,862,016 bytes [500.11 GB / 465.76 GiB]). Simultaneously, [EXC-001]–[EXC-008] and [EXC-PST-EMPTY] (271,360 bytes [271.36 KB / 265.00 KiB]) isolate innocent baseline noise, and kernel UINT64_MAX (18,446,744,073,709,551,615 bytes) Event ID 1006 hardware glitches are filtered out.

Stage 4: 6-Format Deliverables, FRE 902(13)/(14) Certification & Expert Testimony

Clients and counsel receive synchronized Landscape .PDF summaries, .DOCX declaration inserts, 6-Tab and 12-Tab .XLSX provenance workbooks, Dual-Theme .HTML dashboards, .MD/.CSV exports, and SHA-256-authenticated SQLite Super-Timelines—backed by expert testimony from Principal Examiner Gary Huestis.

Put E-Investigations’ Proprietary Lab Technology to Work on Your Case

Call Principal Examiner Gary Huestis at (713) 628-4408 or submit a confidential intake request online.

📞 (713) 628-4408 ⚖️ Case Intake