~

Opening the record

Returning to practice · Los Angeles

Get in touch
Portrait of Magdiel S. Ramos

record/msr-001SHA-256

computing…

Fingerprint of the record below, computed in your browser.

Litigation support · Digital forensics · Legal IT

I build the evidence, the exhibits and the systems law firms try cases on.

Trial presentation, digital forensics and legal IT for plaintiff and defense trial firms, from a single device examination to the hot seat through verdict.

Request a consultation
See engagements
Years in practice
16+
MSP Titans finalist
3×
Capabilities, three disciplines
18

Capabilities

Trial presentation, Hot-seat operation, Demonstrative exhibits, Deposition clip sync, Mobile forensics, Chain of custody, Authenticity analysis, Data recovery, Clio migration, Penetration testing, Incident response, Exhibit databases.

status:
Returning to practice
based:
Los Angeles, for Los Angeles and Orange County trial firms
reach:
Cross-border matters and remote engagements
reply:
With a time for a scoping call

Engagements

The work speaks for itself.

Every matter is de-identified. Every image carries a tag that says what it is.

  • ACTUAL PRODUCT CAPTUREReal footage or screen capture
  • SAMPLE MATTER / DEMONSTRATIONBuilt on invented facts
  • ILLUSTRATIONAtmosphere only, generated and labeled

  1. 01 / 06Legal IT · 2015–2025

    Ten years of firm infrastructure

    IT consultant and engineer to the Law Office of Eric Hershler for a decade, covering the network, systems and security, and the firm’s own mark.

    Role
    IT consultant & engineer
    Scope
    Network, systems, security, firm identity
    • EX-01
    • Legal IT
    ACTUAL PRODUCT CAPTURE
    Tea Time with Eric Hershler00:00 / 01:23

  2. 02 / 06Litigation · 2025

    Trial presentation through verdict

    Courtroom technology and hot-seat operation for a civil rights trial, from opening statement through verdict.

    Role
    Trial technologist in the hot seat
    Matter
    De-identified
    • EX-02
    • Litigation
    ILLUSTRATION

  3. 03 / 06Litigation · Sample

    Collision reconstruction timeline

    A demonstrative built on invented facts, showing how five seconds of data become a sequence a jury can follow.

    Facts
    Invented, labeled as a sample
    Format
    Demonstrative exhibit
    • EX-03
    • Litigation
    SAMPLE MATTER / DEMONSTRATION

  4. 04 / 06Forensics · Sample

    Mobile examination report

    A sample findings report written for counsel, walking from acquisition to conclusion with the chain of custody shown.

    Facts
    Invented, labeled as a sample
    Format
    Written findings for counsel
    • EX-04
    • Forensics
    SAMPLE MATTER / DEMONSTRATION

  5. 05 / 06Published · 2024–2025

    Kaseya Powered Services partner film

    A 3:20 co-branded feature from Kaseya’s Powered Services partner program, with Magdiel Ramos as Founder & CEO of M.R. Ingenuity.

    Format
    3:20, 1080p
    Program
    Kaseya Powered Services
    • EX-05
    • Published
    ACTUAL PRODUCT CAPTURE
    Kaseya Powered Services00:00 / 03:20

  6. 06 / 06Published · 2025

    Digital forensics, introduced to trial lawyers

    A 1:38 introduction to digital forensics made for Trial Lawyers University and narrated by Magdiel.

    Format
    1:38, shot in 4K
    Audience
    Trial lawyers
    • EX-06
    • Published
    ACTUAL PRODUCT CAPTURE
    Trial Lawyers University00:00 / 01:38

Hot seat replay · trial day 3

09:14. The witness goes off script. The page is up in seven seconds.

A moment from the hot seat, replayed line by line. When the story changes on the stand, the exhibit that answers it has to be on every screen before the next question.

Sample matter / invented facts

  1. 09:14:02Witness goes off script
  2. 09:14:09Exhibit page on screen
  3. 09:14:13Callout drawn
  4. 09:14:25Point made · 23 s total

msr replay sample-matter · trial day 3 · 1× speed

$ msr replay sample-matter --from 09:14:00

  1. courtwitness denies receiving the March 4 email
  2. counsel"Pull up the March 4 email."
  3. searchexhibit database · "march 4" · 3 matches
  4. loadPX-112 · page 2 · header with sender and recipients
  5. displayon the courtroom screens · jury monitors live
  6. calloutTo line highlighted · timestamp zoomed
  7. counsel"Is that your address in the To line?"
  8. courtwitness: "It is."
  9. clearscreen back to counsel · PX-112 logged for the record

$

exhibits searched 1time to screen 7 squestions lost 0

The exhibit, annotated

PX-112, page 2. Checked before it went up.

The header of the March 4 email from the replay above. Before a page goes on the courtroom screens, every line that matters is checked, and the notes say how.

PX-112 · page 2 of 3on the courtroom screens

Email header, as produced

Received: from mail.harborline.example ([203.0.113.24]) by mx.ridgeway.example; Tue, 4 Mar 2025 16:02:13 +0000

Message-ID: <20250304160211.4F2A@mail.harborline.example>

Date: Tue, 4 Mar 2025 16:02:11 +0000

From: K. Lane <k.lane@harborline.example>

To: M. Ellis <m.ellis@ridgeway.example>

Subject: Revised delivery schedule

Produced in discoveryPROD-004417

Names, addresses and servers are invented. Every domain ends in .example, a name set aside for samples.

Sample matter / invented facts

  1. 1Received

    Delivered. The recipient’s own mail server logged it at 16:02:13, two seconds after it was sent.

  2. 2Message-ID

    One message. The same ID is in the production and in the recipient’s mailbox export.

  3. 3Date

    Sent at 8:02 a.m. Pacific. The header keeps UTC, so the callout shows local time and nobody converts it in front of the jury.

  4. 4To

    The address the witness confirmed, highlighted for the jury at 09:14:13.

Point at a note, or select it, to find its line on the page.

About

I built my first computer at nine. For sixteen years I was the IT consultant and engineer behind Los Angeles trial firms, and from 2020 I carried that into digital forensics and cyber intelligence, reconstructing what happened from data and presenting it so a jury can follow.

03Open the full record
Portrait of Magdiel S. Ramos
Magdiel S. Ramos · Los Angeles

Subject record

MSR-001 · sealed with SHA-256 in your browser

Name
Magdiel S. Ramos
Role
Founder & Director, Ingenuity Cyber Intelligence
Practicing
Since 2010, for Los Angeles and Orange County trial firms
Disciplines
Litigation support, digital forensics, legal IT
Reach
Cross-border matters and remote engagements
Recognition
MSP Titans of the Industry finalist, 2024 to 2026

In my own words

Who I am, and how I work.

A short video about me and how I work is on the way. Until it is ready, this clip holds its place.

how-i-work.mp4

ILLUSTRATIONAI placeholder

Placeholder clip, AI-generated. The full video about how I work replaces it.

How the work runs

Preserve. Examine. Present.

Evidence moves through three stages, in order. Each one leaves a record the next can rely on.

Sample matter / invented facts

01 Preserve

Acquire the device without changing it, and prove that with a hash.

acquire --device phone-01 --read-only

case
SM-0417 · sample matter
device
phone-01 · received sealed, bag 0042
image
full file system · read only
imaging
100%
sha-256
acquired 7f3a9c0e…1f97c912
sha-256
verified 7f3a9c0e…1f97c912 match
custody
  1. received from counsel, bag 0042 sealed
  2. seal opened on camera, logged
  3. image verified, resealed as 0042-A

Leaves A verified image, and a chain of custody signed at every hand-off.

02 Examine

Rebuild what happened from the data itself, not from the screenshots.

thread 14 · phone-01not in the screenshots6 messages2 of 6 left out

TimeFromMessageScreenshots
18:41ASchedule’s changing againshown
18:42BSince when?shown
18:43ASince the March 4 emailleft out
18:47BNever saw itshown
18:48AIt went to your work addressleft out
18:52Bokshown

Leaves A rebuilt thread, and written findings for counsel.

03 Present

Put the finding on every screen in the room, as a page a jury can follow.

PX-118 · thread 14 · phone-01

  1. ASchedule’s changing again
  2. BSince when?
  3. ASince the March 4 email
  4. BNever saw it
  5. AIt went to your work address
  6. Bok

Callout · 18:48:01“It went to your work address.”

  • Jury monitors live
  • Witness live
  • Bench live
  • Counsel live

Leaves The exhibit on every screen, and on the record.

At a glance

Sixteen years in Los Angeles trial work.

From the IT engineer behind trial firms to forensic examination and the courtroom hot seat.

Figures as of 2026

03Open the record

  • 01Years in practice

    162010 to 2026

  • 02With one firm

    10of 16 years

  • 03In digital forensics

    6of 16 years

  • 04Titans finalist

    32024 to 2026

Milestones, 2010 to 2026

Every one of them on the record

  1. 2010

    Founds M.R. Ingenuity IT Consulting Firm

  2. c. 2015

    Begins ten years with the Law Office of Eric Hershler

  3. 2020

    Adds digital forensics and cyber intelligence

  4. 2026

    Founds Ingenuity Cyber Intelligence

Tools in use

Platforms I work in.

The systems I use on engagements. A platform is called a partnership only once the paper is on file.

10 platforms · 3 groups

04How the work is handled

Trial & practice4

Forensics2

Security & IT4

Key 1 of 10

Trial & practice

TD

TrialDirector

Used for
Trial presentation
Status
In use

Used on engagements. Named as a tool, not a partnership.

The practice

Three disciplines. One buyer: the trial firm.

Each one stands alone. Most matters use two of them, and the best ones use all three.

Request a consultation

Tap a card to open it below

  • File LS-01
    LS-1 to LS-6 · six capabilities

    Trials are won in front of a jury, and what the jury sees is a design problem as much as a legal one. I build the visual case, including opening and closing presentations, demonstrative exhibits, synchronized video and the courtroom systems that run them. Then I sit in the hot seat while counsel tries the case.

    Request a consultation

    Includes

    • LS-1Opening statement and closing argument presentation design
    • LS-2Demonstrative exhibits, timelines and animation direction
    • LS-3Trial presentation and hot-seat operation (TrialDirector)
    • LS-4Deposition designation and video clip synchronization
    • LS-5Courtroom equipment specification, staging and on-site direction
    • LS-6Exhibit database build and management through verdict
    Codes
    LS-1 to LS-6
    Starts with
    A scoping call
    Terms
    In writing, per matter

  • File DF-02
    DF-1 to DF-6 · six capabilities

    Evidence that cannot be explained cannot be used. I acquire, preserve and examine digital evidence under documented chain of custody. I write the findings so that a judge, a jury and opposing counsel can all follow how the conclusion was reached, including the parts that do not help.

    Request a consultation

    Includes

    • DF-1Mobile device and computer forensic examination
    • DF-2Forensically sound acquisition, preservation and chain of custody
    • DF-3Authenticity analysis: metadata, tampering and manipulated media
    • DF-4Artifact reconstruction and reverse engineering
    • DF-5Data recovery from damaged, wiped or locked devices
    • DF-6Written findings and exhibit preparation for counsel
    Codes
    DF-1 to DF-6
    Starts with
    A scoping call
    Terms
    In writing, per matter

  • File IT-03
    IT-1 to IT-6 · six capabilities

    Law firms hold other people’s most sensitive material on infrastructure nobody in the firm has time to think about. I design, build and secure that infrastructure, from the practice management system attorneys live in to the network underneath it. Then I test it the way an attacker would, before someone else does.

    All testing is performed under written authorization and a defined scope of engagement.

    Request a consultation

    Includes

    • IT-1Network and server infrastructure engineering
    • IT-2Clio consulting, configuration and data migration
    • IT-3Penetration testing and vulnerability assessment
    • IT-4IT audits and security posture review
    • IT-5Managed monitoring, endpoint protection and incident response
    • IT-6Firm website design and development
    Codes
    IT-1 to IT-6
    Starts with
    A scoping call
    Terms
    In writing, per matter

Ask before trial

What trial lawyers ask me first.

The questions trial teams send before a trial, typed the way they usually arrive. Pick a topic or write your own. It opens in your email app, and nothing is sent from this page.

Magdiel S. Ramos at a window above a city skyline

Ask MagdielReplies with a time for a scoping call

Confidential. Nothing is sent from this page.

  • Trial starts Monday. Can you load our exhibits into TrialDirector and run the hot seat?
  • Opposing counsel produced screenshots of texts. Can you examine the phone itself?
  • Can you turn five seconds of vehicle data into a timeline the jury can follow?
  • We think this video was edited. Can you check the original file and its metadata?
  • Can you sync the deposition video to the transcript and cut clips for impeachment?
  • Can you test the courtroom’s equipment before jury selection so nothing fails mid-trial?
  • If a witness goes off script, can you pull up the right exhibit page in seconds?
  • Our client’s phone was wiped. Can anything be recovered before trial?
  • Can you build my opening statement presentation from our exhibit list?

One thread, two endings

The same text thread. Two very different trials.

Screenshots of a text thread are produced in discovery. What happens next depends on whether anyone checks them against the phone.

Sample matter / invented facts

From the screenshots arriving in discovery to written findings in counsel’s hands.

Taken at face value

Found at trial

  1. Day 0Screenshots producedOpposing counsel produces screenshots of a text thread.
  2. Day 21Taken at face valueThe images go on the exhibit list as they arrived.
  3. Day 90Phone never examinedNobody asks for the device itself.
  4. Trial, day 2Thread challengedQuestions about the metadata surface in front of the jury.
  5. Trial, day 3Exhibit pulledThe case is rebuilt mid-trial without it.

Checked against the phone

Raised before jury selection

  1. Day 0Screenshots producedThe same screenshots arrive in discovery.
  2. Day 2Phone preservedForensically sound acquisition under chain of custody.DF-2
  3. Day 5Thread rebuiltThe device shows two messages the screenshots left out.DF-1 · DF-3
  4. Day 7Exhibits preparedThe full thread, with its metadata, ready for counsel.DF-6
  5. Day 9Findings deliveredCounsel raises authenticity before jury selection.

The record

Sixteen years, on paper.

Every item here is something someone else created, signed, paid or can confirm. Sixteen attorney references on file.

Ask for references Credentials & recognition

  1. 2026 to Present2f35026

    HEAD -> mainIngenuity Cyber Intelligence · Los Angeles

    Founder & Director

    Digital forensics, cyber intelligence and managed security for law firms and agencies.

    • Forensics
    • Intelligence
    • Security

  2. 2020b2a70f5

    M.R. Ingenuity IT Consulting Firm

    Into digital forensics & cyber intelligence

    The practice adds forensic examination and cyber intelligence to sixteen years of IT and trial technology.

    • Forensics
    • Intelligence

  3. June 5, 2020d10619b

    Alongside counsel Stephen A. King · Los Angeles

    Press conference, LAPD headquarters

    On-site support for the event, and the designer of the graphic made from it.

    • On-site
    • Design

  4. c. 2015 to 20256e920a4

    Law Office of Eric Hershler, APC

    IT Consultant & Engineer

    Ten years running the firm’s infrastructure, and the designer of its EH monogram and firm mark.

    • Infrastructure
    • Security
    • Identity

  5. 2010 to 20267f7dfd8

    # initial commitM.R. Ingenuity IT Consulting Firm · Los Angeles

    Founder & Principal

    Sixteen years of IT engineering and trial technology for Los Angeles and Orange County firms.

    • IT engineering
    • Trial technology

Credentials & recognition

Credentials, with their status.

Held, in progress or scheduled, and three years of recognition. Each card says which.

  • Held

    CHTI · CAIIE

    Certified Human Trafficking Investigator; Certified AI Intelligence Expert.

    McAfee Instituteissuer

  • In progress

    Certified Cyber Intelligence Professional

    Listed as in progress until it is held.

    McAfee Instituteissuer

  • Begins Nov 2026

    AI and Cybersecurity: Strategies for Resilience and Defense

    Professional program, starting November 2026.

    MIT xPROprogram

  • Enrolling Nov 2026

    B.S. Cybersecurity & Information Assurance

    Eleven courses aligned to industry certifications.

    Western Governors Universityschool

  • Finalist

    MSP Titans of the Industry

    Legal Services

    Finalist2026

  • Finalist

    MSP Titans of the Industry

    Owner Under 40

    Finalist2025

  • Finalist

    MSP Titans of the Industry

    Legal Services

    Finalist2024

How an engagement runs

Engagement terms

Nothing starts on a handshake.

How an engagement starts and runs, in the order it happens.

engagement/terms.md

5 terms, every matter

  1. Scoping callstep 1

    A short call to scope the matter.

    First
  2. Engagement letterstep 2

    The work and the rates, in writing. Conflicts are checked before anything begins.

    In writing
  3. Conflictsbefore the letter

    Checked against every prior engagement, before the engagement letter is sent.

    Checked
  4. Confidentialityalways

    Nothing about a client’s matter is discussed, shown or published. Every engagement on this site is de-identified.

    Always
  5. TestingIT & security

    All testing is performed under written authorization and a defined scope of engagement.

    Authorized

Journal

Notes from the field.

  • Latest

    1 min read

    Hello world!

    Welcome to WordPress. This is your first post. Edit or delete it, then start writing!

    Read post

Earlier posts

More notes are on the way.

Before you call

How the work is handled.

Plaintiff and defense trial firms, criminal defense counsel, public entities and the attorneys who serve them.

Another question?

Send it by email with the matter and the deadline. You will get a reply.

Ask by email
How does an engagement start?

A short call to scope the matter, a written engagement letter setting out the work and the rates, then the work. Conflicts are checked before anything begins.

How is confidentiality handled?

Nothing about a client’s matter is discussed, shown or published. Every engagement on this site is de-identified, and the site itself is the proof.

What does testing require before it begins?

Written authorization and a defined scope of engagement, every time.

How are conflicts checked?

Against every prior engagement, before the engagement letter is sent.

What are your rates and terms?

Set out in writing in the engagement letter, per matter.

Do you work outside California?

Yes. Cross-border matters and remote engagements are both available.

A clear next step

Let’s talk about your matter.

Send a line on the matter and the deadline. You will get a reply with a time for a scoping call.

01What do you need?
02When is the deadline?
matter.jsdraft, not sent
export const matter = {
  need: null, // not picked yet
  deadline: null, // not picked yet
  from: "", // your name and firm
  reply: "a time for a scoping call",
}

or write to contact@ici-cyber.com · (866) 290-0558

Nothing is sent from this page. The button opens your email app with the brief filled in.