Hacked Device & Network Investigation Lawyers
Your phone behaves strangely. Emails you never sent appear in the outbox. Someone knows things they should not. You need to know what is on the device, and who put it there.
Our forensic examiners image phones, computers, email tenants and networks without altering them. Our lawyers turn the findings into preservation demands, claims and referrals.
The device is the evidence. Most people destroy it in the first hour.
The instinct is to reset the phone or reinstall the laptop. That erases the proof of how the attacker got in and what they took.
Without that proof, there is no claim against the carrier, the platform or the person responsible. There is only a story.
Forensic imaging preserves the device as it was. Analysis then shows the malware, the sessions, the exfiltration and, often, the entry point.
Devices and inboxes are the entry point for most account theft.
FBI data on the attack patterns that start with a phone, a laptop or an email account.
Once a phone number is hijacked, the FBI notes, criminals use it to send “Forgot Password” requests and intercept one-time passcodes for the victim’s other accounts. Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report; FBI IC3, SIM Swap Public Service Announcement.
Image. Analyze. Act.
Phone and computer imaging
Full forensic images of iOS, Android, Windows and macOS devices, preserved to evidentiary standards.
Spyware and stalkerware detection
Identification of commercial and custom surveillance tools, installation dates and the accounts receiving data.
Email and cloud tenant review
Audit logs, forwarding rules, OAuth grants and session histories across Microsoft 365, Google Workspace and iCloud.
Network and insider investigations
Who accessed what, from where and when. Departing employees, contractors and compromised credentials.
Preservation and production demands
Letters and subpoenas to carriers, platforms and providers before logs are deleted.
Claims and referrals
Civil claims against responsible parties and referrals to law enforcement, with evidence packaged the way agencies need it.
How a device investigation runs.
Preservation first. Analysis second. Legal action on the findings.
Stop using the device
Power it down. Do not reset it. Move communications to a clean device.
Forensic imaging
Examiners create verified images. The original is sealed and preserved.
Analysis
Malware, unauthorized sessions, exfiltration and installation dates are documented.
Third-party records
Carrier, platform and cloud logs are requested to corroborate the device findings.
Report and action
A report written for court or arbitration. Then claims, protective relief or referrals.
Investigators and lawyers, under one roof.
Retired federal law enforcement.
Former federal investigators and analysts who spent their careers on cyber and financial crime. They handle the forensics, the tracing and the contact with current law enforcement.
Arbitrating cybercrime disputes since 2019.
Counsel in more than 130 arbitrations before AAA, JAMS and NAM, most arising from cybercrime and account takeovers. We try these cases on the evidence.
If you think your device is compromised.
What you do in the next hour decides whether the evidence survives.
- Power the device down and set it aside
- Use a different, clean device for calls and password changes
- Change email and banking passwords first, then everything else
- Add a port-out PIN with your mobile carrier
- Write down what you noticed and when
- Factory reset, update or “scan” the device
- Log into sensitive accounts from it
- Confront a suspected insider before evidence is preserved
- Let a repair shop or IT contractor wipe it
- Assume a new phone solves the problem if the number or email is still compromised
From the firm’s writing.
Stolen Phone, Stolen Crypto: Exchange Liability
What happens when a device becomes the key to every account.
Read the articleSIM Swap Lawyer: Verizon, AT&T and T-Mobile in 2026
How carrier records decide SIM swap claims.
Read the articleDark Web Surveillance for Private Clients
How leaked credentials lead back to devices and inboxes.
Read the articleFrequently asked.
Common signs are unexpected password resets, unfamiliar sessions, battery drain, messages you did not send and contacts receiving odd requests.
Only forensic examination confirms it. Stop using the device and call.
Often. Installation dates, the receiving account and physical-access windows narrow it quickly.
Attribution is strongest when device findings are matched with carrier and platform records.
No. Examiners work from a verified image. The original is preserved as evidence.
Yes. Reports are prepared to evidentiary standards and examiners can testify.
Yes. Insider investigations cover access logs, file movement, personal cloud uploads and device activity, under privilege.
Email tenant review is a core part of the practice. Forwarding rules, OAuth grants and session logs usually tell the story.
Other areas of the practice.
Every page of the cybercrime practice, from the first hour of an incident to the final award. Back to the overview.
Think your phone or computer is compromised? Preserve it, then call.
Confidential consultation. We will tell you how to protect the evidence and what it can prove.