Author: Ryan C. Hanks, Master of Forensic Sciences
Role: Digital Forensics Investigator | Litigation Support & E-Discovery Analyst
Contact: Ryanchanks@gmail.com | LinkedIn | GitHub Repository
Key Certifications: RelativityOne Review Pro | Cellebrite Certified Mobile Examiner (CCME) | Google Cybersecurity & AI Professional
An interactive 13-slide technical briefing mapping forensic defensibility, SQLite parsing, multi-source ingestion, and automated load-file validation directly into the civil EDRM lifecycle.
This technical portfolio addresses the common industry misconception that Criminal Digital Forensics and Civil E-Discovery / Litigation Support are disjointed domains.
Operating under the strict evidentiary burdens of the Federal Rules of Evidence (FRE 702), the Frye standard, and Fourth Amendment constraints, forensic investigations map directly to the Electronic Discovery Reference Model (EDRM).
- Stricter Defensibility Standards: Zero tolerance for spoliation, verified cryptographic hash chains of custody, and auditable intake environments.
- Deep File System & Artifact Fluency: Parsing SQLite databases, carving unallocated space, decoding proprietary DVR/NVR codecs, and resolving multi-source timestamp drift.
- Turnkey Relativity Application: Direct transferability to Relativity workspace administration, dtSearch regex querying, structured analytics, Continuous Active Learning (CAL), and verified load-file productions (
.dat/.opt).
| EDRM Stage | Criminal & Forensic Workflow | Civil Litigation & E-Discovery Parallel | Shared Technical Standard |
|---|---|---|---|
| Information Governance | Lab SOPs, Evidence Retention, CJIS, Read-Only Audits | Enterprise Information Governance, Defensible Deletion | Proactive data mapping, chain of custody, and integrity controls. |
| Identification | Exigent Warrants, Custodian Scoping, FLOCK ALPR | Custodian Interviews, Rule 26(f) Discovery Plans, RFPs | Pinpointing key players and multi-modal ESI repositories. |
| Preservation | 18 U.S.C. § 2703(f) Letters, Hardware Write-Blockers | Legal Holds, M365 Purview Silent Holds, Spoliation Defense | Securing data integrity prior to collection. |
| Collection | FFS Bitstream Extractions (Inseyets), Physical Images (.E01) |
Targeted API Collections, Forensic Cloud/M365 Exports | Bitstream capture with SHA-256 cryptographic verification. |
| Processing | Magnet AXIOM, Cellebrite PA, Clock Drift Normalization | Relativity Processing, De-NISTing, MD5 De-duplication, OCR | Converting raw containers into structured, searchable records. |
| Review | Detective Timeline Tagging, Incident Coding Layouts | 1st/2nd Pass Review, Dynamic Coding, Privilege Logs | Evaluating ESI for responsiveness, relevance, and privilege. |
| Analysis | CSLI Tower Azimuth Triangulation, Dwell Anomaly Detection | Continuous Active Learning (CAL), dtSearch, Concept Clustering | Uncovering communication patterns and chronological timelines. |
| Production | Discovery Packets, PII Redaction, Statutory Disclosures | Concordance .dat, Opticon .opt, Bates Stamping, Slipsheets |
Exporting formatted load files with audit-verified metadata. |
| Presentation | Courtroom Testimony, Evidentiary Demonstratives | Trial Director, Deposition Exhibits, Summary Judgment Evidence | Communicating complex technical findings clearly before triers of fact. |
- Scenario: Emergency suspected homicide investigation involving an uncooperative subject and an unconfirmed 200-mile transit route crossing multiple jurisdictional boundaries.
- Technical Breakthrough: Ingested and normalized five disparate ESI streams (Cellebrite Inseyets FFS mobile extractions, carrier CSLI tower dumps, FLOCK ALPR reads, and commercial CCTV video). Correlated cell tower azimuth handoffs with ALPR speed vectors to isolate a 4-minute highway shoulder dwell anomaly, securing third-party video confirming evidence disposal within 48 hours.
- Civil Equivalence: Demonstrates full execution of emergency Ex Parte TRO workflows, high-velocity multi-custodian data exfiltration triage, and verified load-file delivery under strict court deadlines.
scripts/loadfile_validator.py: Python production QC utility that verifies Concordance.datdelimiter counts, field headers, and validates matching.optimage page links.scripts/timestamp_normalizer.py: Python script that standardizes heterogeneous timestamp formats (UTC, GPS Epoch, local DVR drift) into a unified chronological data model.samples/sample_production.dat: Multi-source Concordance load file showcasing metadata mapping across mobile, cellular, ALPR, and CCTV sources.
This project is open-source and licensed under the MIT License.