Worried about what's on your child's phone?
A change you can't put your finger on. A calculator app that asks for a password. A second account you didn't know about. Consumer parental-control tools don't see what a parent often needs to see.
Digital forensics · Texas · by appointment
You think something happened on the device.
We examine it and tell you what the evidence shows.
Private-Eye is a Texas digital-forensics practice for individuals and small businesses. Departing employees, worried parents, suspected tampering, ransomware that just walked in. We read the laptop, phone, or server and deliver a written report you can act on.
NDA on request
Chain of custody preserved
Most matters quoted in 24 hrsEVID-SAMPLE-01
Windows laptop · departing exec
Acquired 2026-05-14T09:11:00Z
sha256:9c2b7e1f8a4d6c5b3a2e0f1d8c7b6a5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b41
EVID-SAMPLE-02
iPhone 14 · concerned parent
EVID-SAMPLE-03
Office workstation · accountant
Illustrative interface mock. Not a real case.
Credentials & commitments- Texas DPS · Private Security BureauLicensed investigations company · #A31200301
- GIAC GCFA · GNFA · GCFEForensics certifications
- OSCP · OSEPOffensive-security qualified
- TALI memberTexas Assn. of Licensed Investigators
- Verified-owner authorizationRequired on every recovery engagement
- Confidential by defaultNDA on request
What we do
Services for individuals & small businesses.
Lost-access recovery
Forgotten the password to files you own? We'll tell you what recovery would involve — and whether it's realistic.
Encrypted drives, BitLocker / FileVault volumes, password-protected ZIP and RAR archives, Office and PDF files. We use dedicated GPU recovery hardware to attempt recovery of data you legally own, always under verified-owner authorization.
Read engagement scope
- Encrypted drives & containers (BitLocker, VeraCrypt)
- Office / PDF / ZIP / RAR password recovery
- Apple Keychain & browser-vault unlock
- Dedicated GPU recovery hardware
Recovery & data access
You own your data. We help you get it back.
A dedicated high-performance GPU cluster for password and credential recovery on assets you legally own. Lost the password to your own encrypted drive, ZIP archive, QuickBooks file, or accounting database? Bring it. We'll attempt recovery, confidentially, and always under verified-owner authorization.
- Encrypted containersBitLocker, FileVault, VeraCrypt, LUKS, Apple disk images, encrypted backups.
Office & archive passwordsWord, Excel, PDF, ZIP, RAR, 7z. QuickBooks, Sage, and accounting-DB unlocks.
Device & file recoveryDeleted photos, documents, and fragments from phones, drives, and SD cards.- Estate & missing-person workProbate-court access, device extraction in coordination with families and law enforcement.
Authorization, every time. Recovery work is performed only with verified ownership of the asset, under a signed engagement letter, and within the limits of the federal Computer Fraud and Abuse Act and Texas Penal Code §33.02 (Breach of Computer Security). No password work on devices you don't own. No exceptions.
Illustrative interface mock of a recovery job in progress. Not a real case.
How we help · example situations
If any of this sounds familiar, this is what we do.
Illustrative situations, they show how a Private-Eye engagement would run. See all 24 scenarios →
An employee resigned. Did the customer list leave with them?
A salesperson joins a competitor and deals start moving the other way. An engineer leaves and the next product ships looking familiar. Texas trade-secret cases live or die on what can be proven about what walked out the door.
Came in Monday to encrypted files? Here's how we'd respond.
A ransom note on every desktop. Your insurer won't pay without proof of how the breach happened, and the first 24 hours decide whether you lose days or months.
Think someone's watching your phone?
Battery draining faster than it should. Texts a partner already seems to know about. Apps you don't remember installing. Commercial stalkerware can be installed in under five minutes if someone has your unlocked phone once.
Locked out of your own encrypted drive or QuickBooks file?
BitLocker, FileVault, a ZIP of tax records, a QuickBooks file the previous bookkeeper locked. The data is legally yours, you just can't get to it.
Not sure how a work computer is really being used?
An HR complaint, a manager's instinct, or an IT alert about bandwidth at odd hours. The conduct may be a firing, a coaching, or nothing, but HR can't go looking themselves without breaking the evidence chain.
How an engagement runs
Four phases. Documented. Reproducible.
The same workflow whether the matter is a single phone or a ransomware response across two locations. Smaller engagements just spend less time in each phase.
01
Intake & scope
A short call (or email) to understand what you're worried about and what we'd need to look at. Fee quote up front. No work begins without a signed engagement letter.
02
Preservation
Write-blocked, hash-verified imaging, at our place or yours. Once we have the image, your device goes home; we work from the copy.
03
Analysis
Artifact extraction, timeline reconstruction, deleted-file recovery, keyword and behavior search. Performed with industry-leading forensic tooling.
04
Report & next steps
A plain-English written report you can hand to a lawyer, an insurer, HR, or a family counselor. We're available for follow-up questions, depositions when applicable, and additional analysis.
Why hire us
Credentials. Experience. Accountability.
Digital-forensic findings often end up in front of HR, an insurer, or a judge, and they can't be improvised. Three reasons this work belongs with a licensed, credentialed practitioner, not a generalist.
01
Credentials
Certifications that take years, not weekends.
OSCP and OSEP for offensive security. GIAC GCFA, GNFA, and GCFE for forensics. Each of these is a practical, hands-on exam rather than a multiple-choice test, and together they cover both offensive security and forensic analysis.
Active certification portfolio
- OSCPOffensive Security Certified Professional
- OSEPOffensive Security Experienced Penetration Tester
- GCFAGIAC Certified Forensic Analyst
- GNFAGIAC Network Forensic Analyst
- GCFEGIAC Certified Forensic Examiner
Professional membershipTexas Association of Licensed Investigators (TALI)
02
Experience
Enterprise incident response, every weekday.
By day, the examiner works in enterprise incident response, in a regulated environment where a single breach carries real consequences and the standards are set by regulators rather than by preference. The hands-on work on your engagement is the same hands-on work done there every weekday.
Working context
- DisciplineEnterprise incident response
- ScaleRegulated, multi-site environments
- CadenceLive incidents, every week
- Applied hereThe same hands, the same methods
03
Cost
Senior expertise without the headcount.
A full-time internal cybersecurity professional or digital-forensics examiner is a permanent cost, carried whether or not there is an incident that week. A consultant is engaged per matter, so you carry no salary, benefits, equipment, or certification overhead between engagements.
A working comparison
Full-time internal examiner
A standing cost
salary, benefits, equipment, training, and certifications, carried year-round.
Consultant engagement
Pay per matter
scoped up front. No headcount, no overhead, no idle capacity to pay for.
Bring us your facts. We'll tell you whether a forensic engagement can answer them.
How we work
A day-job analyst, after the day job.
Private-Eye is run by a working incident-response analyst. The day job is someone else's incident, eight to five. The practice runs in the evenings and on weekends, when most of our clients can actually talk anyway.
That keeps overhead low. It keeps our rates within reach of individuals and small businesses. And it means the examiner reading your laptop is doing this work every single day of the week.
Mon – Fri
5:30 – 11:00 PM CT
Sat
All day
Sun
All day
Intake replies as soon as the examiner is free.NDA engagements available.
Remote intake statewide; on-site by arrangement.Engagement intake
Talk to Private-Eye.
Most engagements are quoted within 24 hours.