Evidence Desk for Law Firms and Insurers
The Evidence Desk is a standing investigative desk for your firm. A monthly allotment of investigator hours, a licensed examiner who already knows your matters, sworn declarations when you need them, and one invoice at the end of the month.
A law firm that hires an investigator per matter pays twice in lost time
Every new engagement costs the same week. Conflicts, an engagement letter, a scoping call, a briefing on facts the last investigator already knew, and a first invoice that arrives before any work product does.
A standing desk removes it. The engagement exists already, the investigator already knows your matters and your standards, and work starts with a phone call rather than a procurement exercise.
The Evidence Desk is a standing desk with a monthly block of investigator hours
A monthly allotment of hours
Your firm holds a set block of investigator hours each month, drawn against as matters require. Unused hours do not roll forward, which is what keeps the desk available to you.
One ledger, one invoice
Every hour, every matter and every deliverable on one monthly ledger, with a single invoice. Client billing becomes a line item instead of a reconciliation.
A named, licensed examiner
The same examiner across your matters, which is why the second matter costs less of your time than the first.
Sworn declarations are the Evidence Desk's standard deliverable
Where a matter needs an anonymous party named, the method is set out on our anonymous defendant identification page.
Corporate business email compromise is inside the Evidence Desk scope
The compromise reconstructed
Tenant records, sign in logs, message trace, malicious inbox rules and application grants, reconstructed into a documented attacker timeline.
The parties identified
The people behind the compromise and the accounts that received the payment, identified and documented rather than described as unknown.
The loss documented
A written record of the compromise, the payment and the causation, built to the standard a carrier, a counsel and a court all require.
Speed is the client's constraint, not a promise from us. The FBI Internet Crime Complaint Center Recovery Asset Team acts on qualifying domestic wires reported within 72 hours, and the bank recall window closes fast. Tell your client that deadline on the first call.
Wire fraud recovery is Southern Recon Agency's lane and stays there
We say this plainly so nobody is misdirected. Recovery work on a stolen wire, meaning the tracing and the clawback of the funds themselves, sits with our sister firm Southern Recon Agency, LLC. The Evidence Desk investigates the corporate compromise and documents the loss. If a matter needs the recovery side, we say so on the first call and point you to the right firm rather than stretching our scope to fit.
Insurers use the Evidence Desk to test a claim before they pay it
Claims teams face the same question repeatedly: is this loss what the insured says it is. A standing desk gives the examiner who can answer it, on documentation that a carrier and a court will both accept. The record we build in a business email compromise loss is described on our insurance claim support page.
One Evidence Desk invoice and one ledger replace a stack of per matter engagements
Firms that run several investigative vendors end up with several engagement letters, several billing formats and no single view of what was spent or what was produced. The desk collapses that into one relationship. Partners see the whole month on one page, and the client sees a clean line rather than an unexplained disbursement.
A partner calls, the desk works against the block, and the month closes with one ledger
Open the desk
Conflicts, the engagement, your standards and your reporting format agreed once, so no later matter repeats it.
Call and go
A partner calls, we scope in the call, and work starts against the monthly block without a new engagement.
Deliver
Findings written the way your firm uses them, as a declaration where the matter needs one.
Ledger
One ledger of hours, matters and deliverables, and one invoice.
The evidence behind a corporate compromise carries the weight of the loss
In one published matter a construction company was owed $500,000 by a vendor, and the payment was intercepted and wired overseas. The record we built led the vendor to pay half of the original invoice, and the client recovered $250,000 it had every reason to believe was gone. That matter is written up as case study 2 on our case studies page.
A standing desk gets interrogated before a firm opens one
What is an Evidence Desk?
Do unused hours roll over?
Is business email compromise included?
Do you handle wire fraud recovery through the desk?
Can the desk be attorney retained and kept inside privilege?
How is the Evidence Desk priced?
Declarations from the Evidence Desk carry one examiner's name across your matters
Matt Aubin, CDFE, FBCI
Managing Partner, E3 Legacy Intel · Southern Recon Agency, LLC, Florida agency license A-1400197
Every matter through the desk is worked under a named, licensed examiner. Matt Aubin brings seventeen years in cybercrime and open source intelligence. He is a Certified Digital Forensics Examiner (CDFE), a Florida Board Certified Investigator (FBCI), and a Certified AI Agent Developer. He has investigated cases jointly with the FBI, the SEC, the U.S. Secret Service, and the U.S. Marshals.
His work has been featured on ABC News, Spectrum News, and The Daily Beast, and in a television pilot for Netflix and MAC Pictures as a cybercrime expert. He keynotes nationally and serves on the Board of Directors of the Florida Association of Licensed Investigators (FALI). The firm is nationwide, and the work is run from Florida. About Matt Aubin
Law firms send the desk identification work and insurers send it claim testing
Call (877) 732-6648 or use the contact form to arrange a confidential call. Scope and fee are quoted in writing after a confidential call.
Tell us what happened
A licensed examiner reads every inquiry. You get a written, flat fee quote before any work starts. Or call (877) 732-6648.
