Excavate or
a forensics firm.
A forensics firm usually investigates one matter once it arises, from whatever evidence survived. Excavate keeps the record before anything happens and investigates as it goes.
Last checked 14 October 2026 · Sources below
A forensics firm is usually engaged once a matter is in view, often through counsel, one matter at a time. Excavate is a subscription: the record starts with whatever history each source still keeps, every departure gets an exit review that ends in writing, and every case ends in a conclusion signed by the examiner. If you still call a firm, it starts from a preserved record and the laptop we asked IT to hold.
Where Excavate
is stronger.
What a subscription does that a firm engaged per matter usually does not.
Excavate keeps the record from the day you connect, so less depends on what survived until someone called a firm.
An exit review for every departure, during offboarding. We ask IT to hold the laptop until it closes.
When something comes up, the record and the examiners are already in place.
Every review and case stays in your portal, cleared ones included.
Excavate reads the systems your people work in, from Microsoft 365 and Google Workspace to Slack, GitHub and your HR system, continuously, not only once a matter starts.
Our AI agent and examiners work every trigger, so a small signal is looked at before it becomes a matter.
Side by side.
| Excavate | A forensics firm | |
|---|---|---|
| When the work starts | From the day you connect, for everyone. | Usually once a matter is in view. |
| What evidence exists | Backfilled from each source. Nothing expires until you delete it. | Whatever survived until the firm is called, unless a hold came earlier. |
| Departing employees | An exit review for every departure, opened from your HR system during offboarding. | Per leaver, when asked. |
| Who does the work | Our AI agent and examiners. Only an examiner escalates or concludes against a person. | The firm’s examiners, engaged per matter. |
| What you hold at the end | A written conclusion, signed by the examiner. | A forensic report on the matter. |
| Devices | Company systems, and company laptops on a case. | Company devices, and personal ones with consent or a court order. |
How a forensics firm works.
In general terms. Firms differ, so ask yours.
Usually once an HR or legal matter is in view, and in step with counsel.
The devices and accounts you hand over, and whatever activity those systems still keep by then.
Usually weeks for one matter, from intake to a written report.
A forensic report on the matter. Some firms also act as a neutral examiner when both sides agree to one.
Some firms preserve a single leaver’s devices and accounts on or shortly after the last day, before anyone has asked a question.
Some large firms also sell ongoing insider threat programs as a subscription service.
Use both.
Excavate keeps the record and reviews every departure. When a matter needs a firm, it starts from a preserved, tamper-evident record and the laptop we asked IT to hold.
Questions buyers ask.
Do we still need a forensics firm?+
For some matters, yes: when you need a neutral examiner, devices you do not own, or lab recovery. With Excavate, the firm starts from a preserved record.
Can a firm work from Excavate’s record?+
Yes. Every conclusion comes with its evidence and chain of custody, ready to share with counsel and the firm they choose.
What is usually gone by the time a firm is called?+
It depends on each system and how it is set up: logs age out, and a leaver’s account and files are usually deleted after they go. Excavate keeps what it reads until you delete it.
Why do you ask IT to hold the laptop?+
Because routine IT work can wipe it. In Cynosure v. Reveal Lasers (D. Mass., findings of 7 August 2025), the company’s own information security department wiped a departing employee’s company computer “in the ordinary course” when he returned it, and no data was recovered from his devices.1 Every Excavate exit review asks IT to hold the laptop until the review closes.
What does our team still do?+
Grant read-only access, ask IT to hold a leaver’s laptop, run our collection tool when a case needs it, and decide what to do with each conclusion.
The court findings are public record. Excavate is not affiliated with or endorsed by any company named on this page. If something here is out of date, write to info@excavate.ai and we will correct it.
See it on your own systems.
Thirty minutes on the systems you run, and what Excavate would do with them.
All comparisons →