Digital Forensics for Utah Family Law and Custody Cases

A text thread may be incomplete. A photograph may have been edited, copied from another source, or placed on a device later. A location record may show where a phone was without proving who carried it. A deleted message may still exist in a backup – or it may be gone.

VRI Computer Forensics helps Utah family law attorneys determine what the available digital evidence can actually support. From our office in Orem, we preserve and analyze phones, computers, cloud accounts, messages, photographs, documents, and other digital sources in divorce, custody, support, and related proceedings.

• Is the message, photograph, document, or recording authentic and complete?
• Does the source data contain context missing from a screenshot or selected export?
• Was a file created on the device, modified there, or transferred from somewhere else?
• Is relevant information still available after deletion?
• What does the device activity show about timing, access, or use?
• Do location-related artifacts support or contradict a person’s account?
• Are there digital leads pointing to undisclosed accounts, assets, or income?
• Can the findings be explained clearly in a declaration, deposition, or hearing?

In a court-appointed custody matter, illicit material was found on a device and presented as evidence against a parent. VRI examined the file history, metadata, and surrounding device activity. The evidence showed that the material had been planted on the device rather than originating there as alleged.

The lesson is broader than that one case: a file’s presence does not by itself establish when it arrived, how it arrived, or who put it there. Those questions require examination of the source data and the surrounding artifacts.

Family-law devices contain intimate, privileged, and irrelevant information. A defensible protocol should address:

• Who has authority to provide or collect the device or account.
• Which dates, custodians, applications, and issues are within scope.
• How privileged and unrelated information will be protected.
• Whether counsel, a neutral reviewer, or the examiner will conduct substantive review.
• What will be reported and to whom.
• How source evidence and working copies will be stored and returned.

We help counsel translate the legal scope into a practical collection and examination plan. We do not decide the legal scope for the court or the parties.

1. Counsel identifies the issue. We discuss the claims, relevant dates, devices, accounts, court orders, consent, privilege concerns, and deadlines.
2. We define preservation and scope. We identify sources at risk and propose a targeted, proportionate plan.
3. We collect defensibly. Available evidence is acquired using methods appropriate to the device or account, with documented handling.
4. We analyze the relevant questions. The review focuses on the issues counsel identified, with broader work performed only when justified.
5. We explain the findings. Depending on the engagement, we may provide a consultation, focused findings, exhibits, a declaration, a report, deposition support, or testimony.

• Cell Phone Forensics for Utah Attorneys
• Computer Forensics for Utah Attorneys
• Document Metadata and Authentication