In the classic model, every device seized in a matter is imaged, indexed and examined in full. That model still works on a two-device instruction; it does not scale to the modern reality of a custodian with a laptop, a work phone, a personal phone, a tablet, a synced cloud drive and three messaging accounts. Triage exists to close the gap between the volume of potentially-relevant material and the budget available to examine it.
What triage actually is
A rapid, targeted acquisition and review of a defined set of devices or accounts, scoped against a written list of triage questions, producing a short note that recommends whether — and where — a full examination is justified. Triage is not less rigorous than a full examination; it is narrower. Everything acquired during triage is acquired to the same evidential standard, so that if the matter escalates, no re-work is required.
When triage is the right first step
- Multi-device custodian instructions where only some of the devices are likely to matter, and the client needs to know which before authorising the rest.
- Urgent applications — search orders, freezing injunctions, without-notice family applications — where an early factual indication of what is on a device is needed to support the application.
- Employment matters where the question is whether the departing employee took anything at all, before deciding to instruct a full exfiltration investigation.
- Criminal defence instructions where the client wants a preliminary view on prospects before committing to a full defence expert report.
- Family Court instructions where the question is whether contested screenshots are consistent with the source device before commissioning a full extraction.
The triage workflow
- 01Scoping. A short call to agree the two or three questions the triage is expected to answer, and the devices in scope. Anything outside those questions is out of scope for triage and, if relevant, reappears in the full-instruction recommendation.
- 02Acquisition. To full evidential standard — hash-verified, chain-of-custody documented — even though only a subset of artefacts will be reviewed. This preserves the option to escalate without re-acquiring.
- 03Targeted review. Focused parsing of the artefact classes that answer the triage questions: recent-file lists, USB history, keyword hits across messaging apps, cloud-sync markers, browser history for a defined window.
- 04Written triage note. Two to four pages: what was acquired, what was and was not found on the scoped questions, indicative estimate for a full instruction if warranted, and — where relevant — the artefact classes that would be examined in that full instruction.
What a good triage note contains
| Section | What it says |
|---|---|
| Scope | The devices/accounts triaged and the specific questions the triage was asked to answer |
| Acquisition summary | Method used per device, hash values, chain-of-custody status |
| Findings | Factual answers to the triage questions, referenced to the artefacts observed |
| Limits | Explicitly, what triage did not examine and therefore cannot speak to |
| Recommendation | Whether a full examination is justified, on which device(s), for what estimated cost and timescale |
What triage is not
- It is not a preview of a full report — findings are provisional to the scope examined.
- It is not a substitute for a CPR Part 35 (or CrimPR Part 19 / FPR Part 25) expert report; the triage note is a working document, not a court exhibit.
- It is not a fishing exercise — vague triage instructions produce vague triage notes.
- It is not a fixed-price product regardless of scope — three devices with defined questions are triageable; twelve devices with no questions are not.
The value of triage is measured by the instructions it prevents you from having to commission, not by the ones it justifies.
Frequently asked questions
For one to three devices with clearly scoped questions, typically 24–72 hours from receipt. For larger multi-device sets, 3–5 working days. Turnaround compresses when the questions are narrower.
The triage note itself is a working document. Where triage findings become material, they are re-presented in a formal expert report drawing on the same acquired material — no re-acquisition required.
Small single-device triage typically £750–£1,500; multi-device triage £2,500–£6,000 depending on scope and platforms in play. The triage fee is normally credited against a subsequent full instruction if one is commissioned.
Yes — Microsoft 365, Google Workspace and iCloud triage is common in employment and commercial matters, subject to appropriate written authority from the account owner or the party with lawful control.
That is a valid — and often valuable — outcome. Confirming that a device or account does not contain material relevant to the pleaded issues avoids a disproportionate full instruction and narrows the disclosure question.