Digital forensics and evidence recovery in Calgary.
Evidence has to clear two bars. It has to be recovered, and you have to be able to show it was not changed along the way. Since 2005 we have handled digital evidence for insurers, forensic engineers, criminal defence and civil counsel, and police services.
What we are asked to work on.
Collision and incident video
Dashcam and camera footage for claims and court.
Hard drives, SSDs and memory cards
Acquired first and analysed from the copy, with audit logs kept throughout.
Computers and laptops
Documents, email and activity records, from failed or working machines.
iPhones, using IPFTS
Logical acquisition through Apple's backup service, with every file hashed and logged.
Disputed or incomplete evidence
An independent recovery and report on what the media actually holds.
How evidence is handled.
- 01
Intake
Each item is logged on arrival, and every hand-off after that is recorded.
- 02
Acquire
Media is acquired following forensic best practice, and every step is recorded in audit logs.
- 03
Analyse
With recognised tools, including PC-3000, DeepSpar, EnCase, FTK and Belkasoft, alongside our own software.
- 04
Report
A written report of what was recovered and how, reviewed before release.
About IPFTS.
IPFTS is our own iOS Forensic Toolset. Every file is hashed as it arrives from the phone, checked again while the evidence package is built, and the finished package is verified a third time. The package is a standard AFF v3 image, so the other side's expert can verify it with free tools rather than our software.
It is also honest about its limits. IPFTS collects what Apple's backup service provides. It does not recover deleted data or read memory chips, and if Apple's backup does not complete, the acquisition is reported as failed, not passed off as complete.
Before anything else happens to the device.
Helpful next steps
- Call before the device is used, opened or charged.
- Keep the device and its accessories together.
- Tell us about deadlines and reporting requirements.
Best avoided for now
- Copy files off it yourself.
- Let anyone browse it "just to check".
- Email the only copy of anything.
Our terms, in plain numbers.
- Who does the work
- iCube Development (Calgary) Ltd., recovering data since 2005.
- Where
- One address, and it is our lab: #610 - 11012 Macleod Trail SE. Recovery is done here by our own staff and is not outsourced. No drop-off depots, no appointment needed.
- Evaluation
- Free standard evaluation within 72 hours, for one device per client. Priority (24 hours) and same-day evaluations, multi-drive arrays and devices another company has opened are quoted before we start.
- Your quote
- In writing, before any recovery work. Nothing extra is done or billed without your approval.
- If we cannot recover your files
- You pay nothing for the recovery, parts included. Any exception, such as a paid diagnostic for a device another company has opened, is agreed with you in writing first.
- Success rate
- We do not publish one. A percentage cannot describe your device; your evaluation tells you what is actually recoverable.
- Your recovered files
- Returned on new media or, with your permission, by secure download. Our working copy is deleted seven days after completion unless you ask in writing to keep it longer.
- Privacy
- Your device and files are handled only by our own staff, who are bound by confidentiality, unless the law requires otherwise.
- Your device
- Please collect it within 30 days. Photo ID is required at pickup.
Questions we get asked.
Is iPhone acquisition the same as recovery?
No. IPFTS collects what Apple's backup service provides. It does not recover deleted data, and our reports say exactly what was and was not collected.
Who can request forensic work?
Insurers, adjusters, lawyers, businesses and individuals with a legal matter. Call first so handling can be agreed before anything is opened.
Can the other side check your work?
For iPhone acquisitions, yes. IPFTS delivers a standard AFF v3 image that any expert can verify with free tools, without our software.
Who signs the report?
Matthew Kinderwater, Director of IT, who leads our forensic work and has written reports used in criminal and civil proceedings.
Where is the evidence processed?
In our Calgary lab, by our own staff. Our analysis tools, including the AI review in IPFTS, run on our own equipment, not on outside services.
Tell us what happened.
Send the details or call (587) 387-2346. We will tell you what to do with the device in the meantime.
Drop-off: Southcentre Executive Tower, #610 - 11012 Macleod Trail SE, Calgary. Monday to Thursday 8:00 AM to 6:00 PM, Friday 8:00 AM to 5:30 PM.