When a wildfire is finally contained, a different kind of investigation begins. Who is responsible? What happened in the critical hours before ignition? And critically — can the evidence prove it?
In an article published in Today’s General Counsel, iDS Managing Director of Digital Forensics and eDiscovery Mark Clews takes readers inside a high-stakes wildfire investigation that illustrates both the complexity of non-standard digital evidence and the decisive difference that rapid, defensible forensic preservation can make.
The Kincade Fire
In 2019, a fire ignited in Northern California near a geothermal power plant, ultimately becoming the largest wildfire in Sonoma County’s history. It burned over 77,000 acres and destroyed an estimated 167 homes before it was contained.
The iDS team was retained to investigate the actions taken by the geothermal facility in the period preceding ignition. The plant was shut down for safety and evidence preservation purposes — making speed essential, both to preserve critical data and to facilitate the facility’s timely restart.
The Data Sources Nobody Expected
A digital forensics team was deployed immediately and began interviewing geothermal, mechanical, and electrical engineers to map the full landscape of potential evidence. What they found went far beyond standard corporate data.
In addition to email communications and standard operating procedure documentation, the team identified and developed strategies to defensibly preserve a range of non-standard sources: CCTV footage, two-way radio audio logs, circuit recloser logs, security access logs, SCADA operations data, anemometer wind telemetry, and mobile device records.
Some of these required unconventional collection methods — including using a cherry picker to retrieve data from equipment mounted on poles and entering pitch-black, shut-down turbine rooms to capture critical logs. In several cases, key data faced imminent overwriting once plant operations resumed. Had preservation not happened quickly, that evidence would have been permanently lost.
From Disparate Data to a Defensible Timeline
Once preserved, the challenge became making sense of it all. The iDS structured data team ingested every source — emails, documents, audio, video, and log files — into a centralised repository, extracting and correlating individual entries to construct a comprehensive, visualised timeline of events.
That timeline told a clear story: the client’s lines had been powered down prior to the fire’s ignition at the PG&E transmission line. The visualised evidence demonstrated unequivocally that the geothermal facility was not responsible.
The California Department of Forestry and Fire Protection ultimately determined that the fire was caused by a PG&E high-voltage transmission line that failed during high winds. PG&E accepted that finding and reached a $55 million settlement with Sonoma County.
Why This Matters Now
As Clews notes, the lessons from the Kincade Fire apply directly to ongoing investigations following more recent major incidents — including the Palisades and Eaton fires in January 2025, which burned approximately 37,000 acres and destroyed more than 16,000 structures across Los Angeles County.
In any high-stakes investigation, success often hinges on identifying which data sources are in scope and acting quickly to preserve those most at risk. Rapid deployment of a team capable of asking the right questions, prioritising preservation, and engineering tailored workflows for non-standard data can be the difference between speculation and proof.
At iDS, our Digital Forensics, Structured Data & Analytics, and Testimony practices work seamlessly together to construct technically rigorous, defensible narratives — grounded in what the evidence shows, and what it definitively rules out.
To connect with an iDS expert, visit idsinc.com.
iDS provides consultative data solutions to corporations and law firms around the world, giving them a decisive advantage – both in and out of the courtroom. iDS’s subject matter experts and data strategists specialize in finding solutions to complex data problems, ensuring data can be leveraged as an asset, not a liability. To learn more, visit idsinc.com.
Having trouble with a technical term used in this post? Check out our Data Investigators Glossary to crack the code.