November 1, 2025
Selling the Science: Marketing of DF/IR Services
"The marketplace is full of solemn jesters—and the people pride themselves on their great men!”
-Friedrich Nietzsche
According to any number of spam-ish emails I receive on a semi-regular basis, the DF/IR industry is a burgeoning multi-billion-dollar industry, projected to be one of the largest and fastest growing in tech sector in the coming years. There are many reasons for this, not the least of which is the marked increase in bad actors exploiting vulnerabilities, stealing information and selling that information across the globe. Combine that with the fact that I tell every attorney – there WILL be data involved in your case in the current environment, and the business line is only poised for more growth. To be sure, there’s a lot of money to be made in DF/IR. I’d dare say that my former law enforcement colleagues who have retired and moved on to private sector roles have seen that there can be a fair amount of resources put into our industries when they attach themselves to the right company.
Marketing these services is also a very large subsect of the industry. I’ve always found it a little difficult to market DF/IR services. We’re not “IT services”, “Investigative Services” or “Legal Services” per se. We are a combination of the three, and when taken individually, those three areas connotate specific skills, but when combined, the skills become more specialized and certainly more boutique.
But marketing can sometimes go too far, and that’s the ultimate point of this article.
Marketing Science
When I teach my Intro to Digital Forensics class at Virginia Commonwealth University, the vast majority of my students are forensic science majors. Currently, there is no DF/IR undergraduate major at the college, so my class is an elective. It makes sense that those involved in the study of forensic science and the application of the “hard sciences” (i.e., chemistry, biology, physics, etc.) within their various forensic applications would branch out into digital forensics. But the consistent corollary I try to draw with them is that in many ways, digital forensics is no different than the hard-science forensics in which they are majoring. We follow a structured investigation. We let the evidence lead us whatever the natural outcomes may be. We conclude based upon facts and application of the relevant scientific principles. And we present all of the facts – not merely those that are favorable to the outcome of the investigation in which we’re working.
But there are notable differences between “hard science” forensics and digital forensics too. DF/IR practitioners don’t generally have to have a degree in chemistry or physics or biology in order to do the work. The vast majority of hard-science forensic practitioners work in the public sector. And many, many of them will not testify to their findings in court, often working behind the scenes.
Along the lines of public vs private sector, because there is a much larger segment of private sector DF/IR practitioners, we see a larger presence of marketing of those services. When is the last time you saw a crime scene tech or DNA analysis firm advertising their services on a regular basis? It doesn’t happen often, perhaps because they are so specialized that they don’t need to. I further suspect that one of the reasons we see much more presence in the private sector practice of DF/IR is because seemingly anyone thinks they can do it, as I wrote about in this previous article. Regardless, the stream of posts about attendance at conferences, speaking engagements, CLEs, sponsorships and other associated marketing activity within DF/IR seems virtually endless. Some of it works well and is commonly accepted and some of it is unorthodox to the point of tacky.
Good Marketing vs. Bad Marketing
Let’s be clear: There are proper ways to market professional services and improper ways to market services. And just like there are professional car salespeople and those that are less than professional (i.e, the “proverbial used car salesman”), the same exists within DF/IR. Let’s start with the low-hanging fruit and work through the list of [what should be] commonly accepted approaches to marketing DF/IR services:
- If you can’t do a thing, don’t tell clients you can do the thing. What do I mean? If you can’t recover deleted messages, don’t “sell” that you can. Increasingly, this type of service is reserved for those who can 1) afford it and 2) who are capable of diving into the data pretty deeply to recover whatever they can. It’s not as simple as button-pushing anymore.
- You are selling yourself and your ability, as much as your tools and capabilities, so make sure your proverbial house is in order too. If you have documented instances in your background of lying, cheating, arrest, etc., then probably best to steer away from an industry where people rely on us to be truthful and operate with professional integrity. If you were a cop, you may very well be fired for lying, so the private sector practice (and marketing thereof) should be no different.
- Accuracy is important. Any of us who do this work on a regular basis know the importance of accuracy in your language, terminology and service offerings. Obfuscating the truth, or glossing over details to make the phone ring, is not a way to gain and build a relationship with clientele. It is penny-wise and pound-foolish.
- We don’t know everything and we haven’t seen everything. On top of that, we are professional problem-solvers, so there’s an element of “fake it till you make it”, or more accurately “I don’t know for sure, but I know I can figure it out” to our business, but it’s important to not stretch too far. If you’ve never worked a criminal investigation, I’m not sure you should be the one working criminal cases. If you’ve never worked as a cellular engineer, I’m not sure you should be pushing out that you know all about cellular network engineering. There’s a fine line between “I’ll figure it out” and “I know everything because I say I do”, laced with buzzwords and BS.
- Importance of networking cannot be overstated. It’s absolutely crucial. See point #2, and add to it that in selling yourself and your ability, you’re also selling your likability. People buy much more based on feelings than on anything else. Networking leads to relationships and relationships equal business. Overlooking this fact is short-sighted.
- Oh, and if the theme wasn’t clear, don’t lie to your potential clientele just to convert an engagement. It’s bad business.
Plenty of Work to Go Around
Earlier, I stated that the DF/IR business sector is slated for huge growth over the next several years for many reasons. And because of that, “competition” is somewhat subjective. Your competition is generally limited to those who are in the same segment as you (i.e., litigation support vs. incident response), what tools they have access to, who their prospective clientele is, how big their staff is, and what their target market is. Those factors alone limit what “competition” you may have.
For example: I ran a small DF shop myself. I had some contractors help, but essentially, it was all me. When I was approached about acquisition, it was not by competitors, even though they do the same work I did. Why? Their reach was larger, their staff was bigger and their target clientele was different. Add into it the existence of other associated lines of business, and there’s no competition there. That’s why they approached me.
There’s plenty of work to go around, and plenty of litigation or investigations or bad actors or whatever the next market, event, case, etc. is waiting around the bend. I don’t look at most other service providers as competitors. Hell, often times, I’m referring a lot of them – just not the ones who market their services like the DF/IR proverbial used car salesman.
After all, my (and your) reputation is on the line too!
About the Author:
Patrick Siewert served 15 years in full-time law enforcement and investigated hundreds of high-tech crimes to precedent-setting results, Patrick is a graduate of SCERS & BCERT and is a court-certified expert witness in digital forensics, mobile forensics and historical cell site location analysis. He has published dozens of articles and is cited in numerous academic papers. He was the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA) and currently serves as Director of Digital Forensics and E-Discovery for a Nationwide (US) provider of DF/IR and e-disco litigation support services, while keeping in touch with the public safety community as a Law Enforcement Instructor in multiple disciplines.
Email: Patrick@ProDigital4n6.com
Patrick Siewert on LinkedIn: https://www.linkedin.com/in/patrick-siewert-92513445/
Patrick Siewert on X/Twitter : @RVA4n6
Pro Digital (old) blog site : https://prodigital4n6.blogspot.com/