Looking for a data recovery services business plan? You're in the right place.
A lab that serves businesses has to answer questions a consumer repair shop never faces. How much cash does a recovery bench, an evidence room and a backup network need before the first invoice? Which revenue line pays the bills while the contract base builds? What does the firm do when a client's data is a legal exhibit, or when the firm itself suffers a breach? A blank template will not show what a sensible answer looks like.
This article walks through a complete sample plan for a business-focused data recovery, forensic imaging and managed backup firm in Tampa, Florida, section by section. It covers the executive summary, the SWOT analysis and the full set of financials, including a downside case.
Here's what you can take from it:
- The executive summary: put the whole firm on one page, so a banker or investor knows what is being asked for within a minute
- Rules the firm works under: see how a plan can describe evidence handling, breach notice and health-data duties without overstating what the law says
- The start-up budget: find out how much of a raise goes to equipment and how much to the reserve, so the first year does not run dry
- The referral and marketing plan: check what a business-to-business lab might spend to win its first 116 customers, and which channels bring them
- The capacity table: test whether the engineers and examiners you plan to hire can handle the cases and hours the revenue line needs
- The five-year profit, cash flow and balance sheet: follow how each hire, price and loan term shows up in the numbers
- The downside case: have an answer ready for a 20% revenue shortfall, along with the steps the owner takes in response
If you are planning a recovery or forensic business that serves other businesses, read this before writing your own. The firm is fictional, so take what fits and change the rest.
In this plan
Want a data recovery services business plan you can edit for your own business? Get the data recovery services business plan template and build it in the Toolkit.
Executive Summary
Ember Cliff, Inc. is a Tampa, Florida firm that recovers data from failed business storage, images devices for law firms and insurers, and runs managed backup for small and mid-size companies. It opens on January 1, 2027, serves businesses only, and has no walk-in counter or consumer work. Founder Daniel Okafor owns 60% and one outside investor owns 40%.
Opening costs $565,000: $110,000 of Daniel's savings, $255,000 of investor equity and a $200,000 bank term loan. Lab, forensic and backup equipment and the lab fit-out take $204,000. A $291,000 reserve carries the firm through a thin first year, and the other $70,000 pays for opening stock, legal work, licensing review, launch marketing and the first engineer's pre-opening pay.
| Year 1 | Year 2 | Year 3 | |
|---|---|---|---|
| Revenue | $552,140 | $910,799 | $1,223,218 |
| Net income after start-up costs | ($140,728) | ($40,882) | $34,050 |
| Closing cash | $192,261 | $133,481 | $150,909 |
By Year 5 revenue is $1,724,561 and net income is $146,960, a net margin of 8.5%. The business has three revenue lines. Per-case recovery brings in the most money in 2027 (53.4% of revenue), forensic imaging at an hourly rate follows, and monthly backup contracts start at four signed clients and grow to 24 by December 2027 and 80 by Year 5. Backup is the smallest line at launch and the most valuable one over time, since it bills every month while recovery and forensic work arrive as events.
Year 1 and Year 2 both lose money, because payroll for the examiner and engineers and depreciation on the lab equipment run ahead of the contract base. Operating profit turns positive in June 2027, and the first full-year profit arrives in Year 3.
A stress run cuts every revenue line by 20%. Daniel takes a pay cut, marketing shrinks, three hires slip or are dropped, and nobody is paid a distribution. Year-end cash stays positive in all five years on the annual view, and the lowest balance is $36,950.
The Lab and the Business
Legal name: Ember Cliff, Inc., a Florida corporation. Owners: Daniel Okafor 60%, outside investor 40%. Premises: a leased flex unit of about 2,400 square feet in the Tampa area, split between a recovery lab, an evidence room and a small office. Start date: January 1, 2027. Stage: pre-launch. Four backup contracts are signed, and the lease is at letter-of-intent stage.
The promise to clients
When a company loses its data, the firm tells the owner what can be recovered and what it will cost before the work starts, handles every device in a documented chain of custody, and charges nothing for a case that returns no data. For clients that want to avoid the call altogether, it backs their systems up and proves the backups restore.
Where the firm stands after two years
- 24 managed-backup clients by December 2027, 42 by December 2028.
- A monthly revenue run rate above the break-even figure in the ratios table during 2028, and a profit in 2029.
- At least ten referral partners (managed IT providers, law firms and claims offices) sending work by the end of 2027.
- Five people on payroll, Daniel included, by the end of 2028.
Three services, three ways of earning
| Service | How it is priced | Year 1 share of revenue |
|---|---|---|
| Business data recovery: failed drives, RAID and NAS arrays, servers, water- and storm-damaged media | Quoted per case after evaluation; $2,950 average | 53.4% |
| Forensic imaging and evidence collection for counsel, insurers and employers | $215 an hour | 27.3% |
| Managed backup with a second-site copy and monthly restore tests | $620 a month on average | 19.3% |
Rules the firm works under
Four bodies of rules shape how the firm handles other people's data. Each is summarized here at a high level, and the firm's counsel confirms the current text before the first case.
- Breach notification. Florida's Information Protection Act (section 501.171 of the Florida Statutes) sets the duty to notify. As the page reads when this plan was written, a firm that holds a client's personal data as a service provider must tell that client of a breach within 10 days of determining it. The client itself generally has 30 days to notify the people affected, and a breach touching 500 or more people in Florida also goes to the Department of Legal Affairs. Ember Cliff's contracts put its own 10-day duty in writing and set a shorter internal target.
- Health data. A medical or dental client covered by HIPAA will usually expect a business associate agreement before the firm touches a drive. The contract set includes a template that counsel drafts and reviews for each client.
- Evidence handling. Every device that arrives for forensic work is logged, photographed and hashed, copied through a write blocker and stored in the locked evidence room. The firm writes its procedures with public guidance such as NIST Special Publication 800-86 in view. A court decides whether evidence is admitted, and the firm's job is to document what it did and why.
- Licensing. Florida regulates private investigation under Chapter 493. Whether forensic examination for a law firm falls within it depends on the work and how it is described, so the firm takes counsel's written view before its first forensic engagement. The start-up budget carries $6,000 for local registrations and that review.
Tampa Bay's Data-Loss Market
Who loses data, and when
Business data fails in ordinary ways: a RAID array that degrades unnoticed, a laptop dropped on a job site, a server with no tested backup, a ransomware infection, an employee who deletes a shared folder. Florida adds a seasonal cause. The Atlantic hurricane season runs from June 1 to November 30, according to the National Hurricane Center, and the plan expects flood, power-surge and water damage to lift recovery cases between June and November. The 2027 monthly forecast reflects that, with recovery revenue at $26,550 in June and $35,400 in October against $11,800 in January.
How the firm prices
The prices in this plan are its own and are not market quotes. Recovery cases are billed at an average of $2,950: a single failed drive usually sits below that, a rebuilt RAID or NAS array above it, and the occasional server case well above. Forensic work bills at $215 an hour. Backup averages $620 a month. All three rise 3% a year from Year 2. Before opening, the firm would test them against quotes from two or three competing labs and managed providers in the Tampa area.
What a client could do instead
| Alternative | What it offers | Why a client picks it | How Ember Cliff differs by design |
|---|---|---|---|
| National recovery labs | Ship-in service with large clean-room capacity | Established brand and capacity for the hardest cases | Local drop-off and courier, one contact and chain-of-custody paperwork, with backup under the same contract |
| Managed IT providers | Backup bundled into a monthly IT contract; recovery cases sent out | Already trusted and already on site | Ember Cliff sells them overflow lab work and does not compete for their IT contracts |
| Independent forensic consultancies | Hourly examiners with no recovery lab | Experience giving testimony | A recovery bench under the same roof for damaged media |
| In-house IT or cloud sync | Low cost, no new vendor | Convenience | Tested restores and a copy held outside the primary account |
| Consumer repair shops and retail chains | Walk-in recovery at a low entry price | Convenience and a visible storefront | No consumer counter; business contracts and written engagement terms |
Each row describes a category and where Ember Cliff sits against it. No provider is named, because offers and prices change often and each publishes its own.
SWOT
| Strengths | Weaknesses |
|---|---|
| Recovery, forensic and backup skills under one roof | Daniel is the only examiner until month 7 |
| Written evidence procedures and a locked evidence room from day one | No brand in Tampa Bay and no case history |
| Four backup contracts signed before opening | Two loss-making years and a heavy equipment base |
| Opportunities | Threats |
|---|---|
| Managed IT providers that would rather buy lab capacity than build it | National labs and large IT providers discounting to win local accounts |
| Law firms and claims offices looking for a local examiner | A single failed recovery or breach that damages a referral relationship |
| Storm-season demand converting recovery clients into backup clients | Cloud services shrinking the pool of on-premises drives and arrays |
Who Pays for Recovery, and Why
Three kinds of buyer
Owner-run businesses with 10 to 150 staff are the core: law, medical and dental practices, accounting and engineering firms, construction and property companies. They own a file server or network drive, a few dozen laptops and a cloud account nobody has tested. The decision-maker is usually the owner or the office manager, who pays when a failure stops the work.
Law firms, insurers and employers need a defensible copy of a device: a departing employee's laptop, a phone in a dispute, a drive in a claim. Counsel or a claims adjuster signs the engagement, and invoices run to 30 to 45 days.
Managed IT providers hold the client relationship but not the lab. They send failed devices out and want a local partner that returns the client to them afterward.
What sets off a purchase
A failure triggers recovery. A scare triggers backup: a competitor's ransomware story, an insurance renewal that asks about backups, or a storm warning. Forensic work follows a dispute, a departure or a claim.
What they ask before they sign
Buyers ask for a quote before work starts, a named person to call, written terms on what happens if nothing is recovered, and where the data sits during the job. Law firms add proof of how a device was handled. Health clients ask about a business associate agreement.
Winning Referrals and Contracts
Where the first 116 customers come from
In 2027 the plan counts 116 distinct new customers: about 90 recovery customers, 14 referral accounts that supply forensic work, and 12 backup clients who arrive without a prior recovery case. Recovery customers arrive from three sources: roughly 35 from managed IT partners, roughly 35 from local search and a map listing, and about 20 from accountants, insurance brokers and law-firm contacts. Backup adds 20 clients in the year on top of the four signed before opening. Eight of those 20 convert from recovery customers already counted, seven come through partners and five come direct.
From first call to signed work
A recovery inquiry gets a call back within four hours and a free evaluation. A written quote follows with a price range and the terms for a case that returns no data. Cases above $5,000 take a deposit, and data is released against payment. Backup starts with a free assessment of the client's systems and a restore test, then a 12-month contract.
Marketing budget
Year 1 marketing is $56,000: $36,000 of operating spend plus the $20,000 launch campaign paid from start-up funds. Divided by 116 new customers, that is about $483 each. The $20,000 launch covers the website, referral-partner events and a readiness mailer in April and May ahead of hurricane season. The operating budget covers local search and map listings, partner lunches and sponsorships, and a quarterly webinar for law-firm contacts. Operating marketing rises from $36,000 to $48,000 by Year 5.
The hurricane-season calendar
April and May carry the readiness mailer and free backup assessments. June to November is when the firm expects more water-damaged media. The bench runs over its monthly capacity in peak weeks, and overtime and the partner lab absorb the surge. December to February is spent on contract renewals and partner reviews.
Running the Lab
Premises and fit-out
The lab and office take about 2,400 square feet at $55,000 a year, all in, a planning figure to be compared with broker quotes. The lease search excludes buildings in flood zones and requires a ground-floor unit with its own electrical panel. The $38,000 fit-out pays for ESD flooring, power, access control and cameras, and a locked evidence room with a log. From Year 4 the firm moves to about 3,000 square feet at $78,000, with a further $30,000 for the move and the new space's fit-out.
How a case moves through the lab
A device is logged on arrival with photographs and a serial number. The engineer makes a hashed image through a write blocker and never works on the original if it can be avoided. The firm recovers files from the image and checks them with the client. Then it returns the device and the recovered data, and keeps the image for a retention period set in the contract. The clean-air workstation covers drive opening and board-level repair. Head swaps beyond its scope and chip-off work go to a partner laboratory, whose fee sits in direct costs. The plan prices on about 77% of evaluated cases returning data, and a turnaround target of 5 to 10 business days.
Backup operations
The backup service runs on appliances leased for each client site and a replication node at a second site that is away from Tampa Bay's flood and wind exposure. The systems engineer monitors jobs daily and runs a restore test for each client every month. The support technician, from month 20, handles intake and alert triage.
Capacity
| Year 1 | Year 3 | Year 5 | |
|---|---|---|---|
| Recovery bench hours needed | 1,020 | 1,734 | 2,142 |
| Recovery engineers on payroll | 1 | 2 (second from month 20) | 2 |
| Forensic hours billed | 700 | 1,300 | 1,650 |
| Forensic examiners, Daniel included | 1, then 2 from month 7 | 2 | 3 |
| Backup clients at year end | 24 | 58 | 80 |
Year 2 needs about 1,428 bench hours, which one engineer's 1,170 cannot cover until the second engineer arrives in month 20, after which capacity is about 1,660. Peak months run over capacity in every year, and the partner lab takes that surge. Daniel bills about 400 forensic hours a year after management and selling, an examiner about 1,100, so Year 4's 1,500 hours fills both and the second senior examiner follows in month 44. One systems engineer carries 80 backup clients by Year 5 with the support technician's help, and that ratio is the plan's tightest.
Insurance and recordkeeping
Insurance covers technology errors and omissions, cyber liability, general liability, workers' compensation and property, including customers' media held in the lab. It costs $24,000 in Year 1. Contracts, the evidence log and image hash records are kept in a system with its own access log and offsite copy.
Vendors and partners
Equipment and parts vendors, a partner lab for the most advanced cases, a managed security provider for the firm's own network and outside counsel. Any of them can be replaced within weeks.
The Team and the Investor
Daniel Okafor, founder and lead examiner
Daniel has eleven years in IT, the last six at a Tampa managed-service provider where he built the backup practice and ran a small imaging bench for law-firm discovery requests. He holds a digital-forensics certification. His $110,000 is personal savings. He is leaving to build a lab that managed providers, his former employer among them, can buy capacity from.
Where the team is thin
Three gaps stand out. Daniel has never run a sales pipeline and sells all the early referral work himself. He has not testified as an expert, so the firm retains a consulting expert for any matter that heads to court. And until month 7 he is the only forensic examiner, which the contract set addresses with a retained contract examiner for peaks.
If Daniel is out
The forensic examiner hired in month 7 can run imaging engagements alone, and the second senior examiner in month 44 adds a second signing examiner alongside the capacity. Until then the firm carries key-person life and disability cover on Daniel, with the investor named in the shareholder agreement.
The outside investor
The investor is a Tampa business owner with a background in IT services, holds 40% for $255,000 and has no day-to-day role. A two-person board of Daniel and the investor meets quarterly and reviews cash against the downside case.
Non-solicitation
Daniel's employment agreement with his former employer carries a non-solicitation clause, and counsel has reviewed it. The four signed backup contracts come from partner introductions and direct leads rather than from that employer's client list.
Outside help
A part-time adviser who runs a regional managed-service provider reviews pricing quarterly. An attorney handles contract templates, the business associate agreement and the licensing opinion.
The Five-Year Model
Ember Cliff's forecast runs for five years: 2027 month by month, then one column per year. The operating figures come first so that every line in the tables can be traced to a stated price, volume or headcount.
Lab, equipment and funding at opening
| Use of funds | Amount |
|---|---|
| Recovery bench: imagers, head and board tools, firmware tools, power supplies | $78,000 |
| Clean-air workstation, microscope and ESD-safe benches | $22,000 |
| Forensic workstations, write blockers, evidence servers and storage | $34,000 |
| Backup core: lab storage and a second-site replication node | $32,000 |
| Lab and evidence-room fit-out: access control, cameras, ESD flooring, power | $38,000 |
| Opening stock of donor drives, circuit boards and head assemblies | $18,000 |
| Tampa and Hillsborough County registrations; licensing review for forensic work | $6,000 |
| Legal: entity, evidence-handling policy, service and backup contracts, investor documents | $12,000 |
| Pre-opening pay for the first engineer: vendor training and process testing | $14,000 |
| Launch: website, referral-partner events, hurricane-season readiness mailer | $20,000 |
| Cash reserve for the ramp-up months and the storage bills ahead of backup revenue | $291,000 |
| Total uses | $565,000 |
| Source of funds | Amount |
|---|---|
| Daniel Okafor's savings | $110,000 |
| Outside investor (minority equity) | $255,000 |
| Bank term loan | $200,000 |
| Total sources | $565,000 |
Opening takes $565,000. Daniel Okafor puts in $110,000 of savings, one outside investor puts in $255,000 for a 40% stake, and a bank term loan supplies $200,000. Equity is $365,000, or 65% of the total. The loan runs seven years at 10.75%, with interest only for the first twelve months, and would be secured on the lab and backup equipment plus Daniel's personal guarantee. The rate is the plan's own figure and no lender has committed to it. Equipment and fit-out come to $204,000, the opening stock of donor parts to $18,000 and the one-off start-up costs (legal, licensing, launch marketing and the first engineer's pre-opening pay) to $52,000. That leaves a $291,000 reserve, the largest single use of funds. It is sized so the 20% revenue shortfall in the last table still ends every year with cash in hand.
Operating figures behind the forecast
- Business recovery: 100 billed cases in 2027, rising to 140, 170, 195 and 210. The average bill is $2,950 in Year 1 dollars. It blends single-drive jobs, RAID and NAS rebuilds, and a few server cases, and prices rise 3% a year from Year 2. About 30 more cases are evaluated than billed (130 in Year 1, so roughly 77% return data), because a case with no recoverable data is not charged. Target turnaround is 5 to 10 business days.
- Bench time is set at 9 hours for each billed case and 4 for each unbilled one, which gives 1,020 hours in Year 1 and 2,142 in Year 5. One engineer supplies about 1,170 productive hours a year. The second engineer, from month 20, lifts capacity to about 1,660 hours in Year 2 against 1,428 needed, and Year 5 runs at 92% of two engineers. In the June-to-November peak the bench runs over its monthly capacity, and overtime and the partner lab absorb the difference at the direct-cost rate below.
- Forensic work bills at $215 an hour in Year 1 for 700 hours, then 1,050, 1,300, 1,500 and 1,650 hours. The 700 hours come from about 25 engagements across roughly 14 law-firm, insurer and employer accounts. An examiner delivers about 1,100 billable hours a year and Daniel about 400 once management and selling are counted, so two people cover 1,500 hours. Year 4 reaches that, which is why the second senior examiner starts in month 44; Year 5 then uses 63% of 2,600 hours.
- Managed backup starts with four signed contracts and ends 2027 with 24, then 42, 58, 70 and 80 clients at year end. The average contract bills $620 a month for 15 to 40 protected endpoints and one or two servers, replicated to a second site, on 12-month terms. Net additions of 18, 16, 12 and 10 clients in Years 2 to 5 sit on top of churn of about 6% a year. Client-site appliances are leased from the backup vendor on 36-month terms, and the lease cost sits inside the direct-cost rate below. The opening backup equipment covers the lab's own storage and the second-site node.
- Direct costs are 38% of backup revenue (cloud storage, backup-software licenses, appliance leases and replication bandwidth), 22% of recovery revenue (donor parts, advanced-lab partner fees and shipping) and 8% of forensic revenue (storage media and evidence supplies). The engine charges later years at the Year 1 blend of 21.3%, so a separate operating line adds the extra storage and license cost as backup grows to 36% of revenue by Year 5.
- Each salary carries a 27% load for payroll taxes, health cover, workers' compensation and a retirement match. Pay raises of 3% a year start in Year 2 and sit on their own line, so the salaries in the personnel table are the launch-year rates. All seven roles are full-time salaried positions. The second recovery engineer's $75,000 sits above the first engineer's $72,000 because the hire is made 19 months later.
- The lab and office take 2,400 square feet at about $23 a square foot a year, all in, which is $55,000. From Year 4 the firm moves to about 3,000 square feet at $26, or $78,000, and a separate $30,000 line covers the move and the fit-out of the new space. Both rents are planning figures to be compared with broker quotes for Tampa flex space.
- Insurance covers technology errors and omissions, cyber liability, general liability, workers' compensation and property, and it includes cover for customers' media held in the lab. It costs $24,000 in Year 1 and $35,500 in Year 5. Policy wording on evidence and client data held in custody would be settled with a broker before the first case.
- Receivables are held at 30 days, a cautious blend: recovery cases are paid before data is released, which shortens it, and law firms and insurers pay on 30 to 45-day terms, which lengthens it. Backup is billed monthly by bank debit. Payables average 25 days and donor stock carries about 10% of a year's direct costs. A bad-debt allowance applies to the law-firm and insurer invoices.
- The model taxes the firm as a C corporation at 21% federal (current law, to be confirmed with the firm's accountant) and 5.5% Florida (the rate on the Florida Department of Revenue's corporate income tax page, which may change), after carrying the early losses forward. Federal rules cap how much of a later year's income earlier losses can offset, which the model does not apply, so Year 3 and Year 4 tax would be modestly higher in practice. An outside investor with a stake makes a C corporation the likelier structure. Income tax first appears in Year 4 at $151 and reaches $49,892 in Year 5.
- Owner distributions of $40,000 in Year 4 and $60,000 in Year 5 are paid pro rata to both shareholders (60% Daniel, 40% the investor) only when cash allows. The loan runs its full term with no early repayment.
Revenue by line of work
| Revenue stream | Year 1 | Year 2 | Year 3 | Year 4 | Year 5 |
|---|---|---|---|---|---|
| Managed backup contracts (monthly) | $106,640 | $252,886 | $394,655 | $520,313 | $628,034 |
| Business data recovery (per case) | $295,000 | $425,390 | $532,041 | $628,591 | $697,253 |
| Forensic imaging and evidence work (hourly) | $150,500 | $232,523 | $296,522 | $352,404 | $399,274 |
| Total revenue | $552,140 | $910,799 | $1,223,218 | $1,501,308 | $1,724,561 |
| Growth on prior year | – | 65% | 34% | 23% | 15% |
Recovery is the largest line in 2027 at 53.4% of revenue, with forensic work at 27.3% and backup at 19.3%. Backup is the line that compounds: monthly billing builds a base that renews, and its share reaches 36.4% of revenue by Year 5 against 40.4% for recovery and 23.2% for forensic work. Recovery customers are also the firm's best source of backup contracts, because a client that has just paid to get its data back is the likeliest to pay to protect it.
Month by month in 2027
| Month | Managed backup contracts (monthly) | Business data recovery (per case) | Forensic imaging and evidence work (hourly) | Total revenue | EBITDA |
|---|---|---|---|---|---|
| Jan 2027 | $2,480 | $11,800 | $4,515 | $18,795 | ($23,773) |
| Feb 2027 | $3,100 | $14,750 | $6,020 | $23,870 | ($19,778) |
| Mar 2027 | $4,340 | $17,700 | $8,815 | $30,855 | ($14,279) |
| Apr 2027 | $5,580 | $17,700 | $11,180 | $34,460 | ($11,441) |
| May 2027 | $6,820 | $23,600 | $12,685 | $43,105 | ($4,635) |
| Jun 2027 | $8,680 | $26,550 | $14,190 | $49,420 | $337 |
| Jul 2027 | $9,920 | $29,500 | $14,835 | $54,255 | $4,143 |
| Aug 2027 | $11,160 | $32,450 | $15,695 | $59,305 | $8,119 |
| Sep 2027 | $12,400 | $29,500 | $15,910 | $57,810 | $6,942 |
| Oct 2027 | $13,020 | $35,400 | $15,910 | $64,330 | $12,075 |
| Nov 2027 | $14,260 | $29,500 | $15,910 | $59,670 | $8,406 |
| Dec 2027 | $14,880 | $26,550 | $14,835 | $56,265 | $5,726 |
Monthly revenue starts at $18,795 in January 2027 and peaks at $64,330 in October, helped by the June-to-November hurricane and flood season. Operating profit (EBITDA) is negative from January to May and positive from June to December. Cash at month end, after allowing for the 30-day collection lag, is lowest in Jul, at about $155,000.
Who is on payroll, and from when
| Role | Annual wage | Starts | Year 1 end | Year 2 end | Year 3 end | Year 4 end | Year 5 end |
|---|---|---|---|---|---|---|---|
| Founder and lead examiner | $105,000 | Month 1 | 1 | 1 | 1 | 1 | 1 |
| Recovery engineer | $72,000 | Month 1 | 1 | 1 | 1 | 1 | 1 |
| Forensic examiner | $86,000 | Month 7 | 1 | 1 | 1 | 1 | 1 |
| Backup and systems engineer | $80,000 | Month 11 | 1 | 1 | 1 | 1 | 1 |
| Support technician (intake, backup monitoring, restore tests) | $52,000 | Month 26 | – | – | 1 | 1 | 1 |
| Second recovery engineer | $75,000 | Month 20 | – | 1 | 1 | 1 | 1 |
| Second senior forensic examiner | $90,000 | Month 44 | – | – | – | 1 | 1 |
| Total payroll incl. on-costs | $296,333 | $475,298 | $591,397 | $644,525 | $711,200 |
Daniel and the first recovery engineer start in January. The forensic examiner joins in month 7, once forensic billings reach about $15,000 a month, and the backup and systems engineer in month 11, with 23 clients under contract. Until then Daniel and the recovery engineer deploy and test the first backup installations, about 35 hours a month. The second recovery engineer starts in month 20, the support technician in month 26 and the second senior forensic examiner in month 44. Headcount at year end is 4, 5, 6, 7 and 7. Year 1 payroll of $296,333 is Daniel and the engineer for twelve months, the examiner for six and the systems engineer for two, with 27% on top. Daniel's $105,000 salary is inside the costs, so the profit lines show what remains after he is paid.
Profit and loss
| Year 1 | Year 2 | Year 3 | Year 4 | Year 5 | |
|---|---|---|---|---|---|
| Revenue | $552,140 | $910,799 | $1,223,218 | $1,501,308 | $1,724,561 |
| Direct costs (cloud storage and backup licenses, donor parts, partner-lab fees) | ($117,463) | ($193,765) | ($260,229) | ($319,391) | ($366,886) |
| Gross profit | $434,677 | $717,034 | $962,989 | $1,181,917 | $1,357,675 |
| Payroll incl. on-costs | ($296,333) | ($475,297) | ($591,397) | ($644,525) | ($711,200) |
| Rent | ($55,000) | ($56,700) | ($58,400) | ($78,000) | ($80,300) |
| Utilities | ($9,000) | ($9,300) | ($9,600) | ($11,500) | ($11,900) |
| Marketing | ($36,000) | ($40,000) | ($44,000) | ($46,000) | ($48,000) |
| Insurance | ($24,000) | ($27,000) | ($30,000) | ($33,000) | ($35,500) |
| Professional fees | ($8,000) | ($8,500) | ($9,000) | ($9,500) | ($10,000) |
| Software subscriptions | ($22,000) | ($26,000) | ($30,000) | ($33,000) | ($36,000) |
| Bad debt allowance on law-firm and insurer invoices | ($2,000) | ($4,000) | ($5,500) | ($6,500) | ($7,200) |
| Training, vendor certifications and expert-witness preparation | ($5,000) | ($7,000) | ($8,000) | ($9,000) | ($9,500) |
| Phones, courier, secure shipping and evidence supplies | ($5,500) | ($7,000) | ($8,000) | ($8,800) | ($9,500) |
| Equipment replacement and new-hire kit | $0 | ($9,000) | ($12,000) | ($18,000) | ($14,000) |
| Year 4 lab move: fit-out and moving costs | $0 | $0 | $0 | ($30,000) | $0 |
| Added storage and license cost as backup grows beyond its Year 1 share | $0 | ($14,500) | ($30,500) | ($44,800) | ($57,100) |
| Annual pay raises (3% a year) | $0 | ($14,259) | ($36,016) | ($59,765) | ($89,262) |
| EBITDA | ($28,157) | $18,478 | $90,576 | $149,527 | $238,213 |
| Depreciation | ($39,071) | ($39,071) | ($39,071) | ($39,071) | ($30,571) |
| Interest | ($21,500) | ($20,288) | ($17,454) | ($14,300) | ($10,790) |
| Income tax | $0 | $0 | $0 | ($151) | ($49,892) |
| Net income before start-up costs | ($88,728) | ($40,882) | $34,050 | $96,004 | $146,960 |
| Start-up costs expensed at opening (legal, licensing, launch marketing) | ($52,000) | $0 | $0 | $0 | $0 |
| Net income after start-up costs | ($140,728) | ($40,882) | $34,050 | $96,004 | $146,960 |
Year 1 loses $88,728 before start-up costs and $140,728 after them. Year 2 still loses $40,882: the examiner and systems engineer now draw a full year of pay, the second recovery engineer starts in month 20 and the first 3% raises land, all before backup revenue has built up. Year 3 earns $34,050, a 2.8% net margin. Margin rises to 6.4% in Year 4, even as the firm pays $30,000 to move into the larger lab and the senior examiner starts, and to 8.5% in Year 5. The early losses mean income tax barely registers until Year 5.
Cash movements
| Year 1 | Year 2 | Year 3 | Year 4 | Year 5 | |
|---|---|---|---|---|---|
| Cash from operations | ($168,739) | ($33,693) | $45,349 | $110,355 | $157,685 |
| Lab, forensic and backup equipment, fit-out | ($204,000) | $0 | $0 | $0 | $0 |
| Funding received | $565,000 | $0 | $0 | $0 | $0 |
| Loan principal repaid | $0 | ($25,087) | ($27,921) | ($31,075) | ($34,585) |
| Owner distributions | $0 | $0 | $0 | ($40,000) | ($60,000) |
| Net change in cash | $192,261 | ($58,780) | $17,428 | $39,280 | $63,100 |
| Closing cash | $192,261 | $133,481 | $150,909 | $190,190 | $253,289 |
Closing cash is lowest at the end of Year 2, at $133,481, after Year 2 absorbs $33,693 of operating cash outflow and $25,087 of loan principal, the first repayments after the interest-only year. It rises every year after that. Distributions start in Year 4, when cash from operations is $110,355.
Balance sheet
| At year end | Year 1 | Year 2 | Year 3 | Year 4 | Year 5 |
|---|---|---|---|---|---|
| Cash | $192,261 | $133,481 | $150,909 | $190,190 | $253,289 |
| Accounts receivable | $45,381 | $74,860 | $100,538 | $123,395 | $141,745 |
| Donor drives, boards and head assemblies | $29,746 | $37,376 | $44,023 | $49,939 | $54,689 |
| Lab, forensic and backup equipment, fit-out (net) | $164,929 | $125,857 | $86,786 | $47,714 | $17,143 |
| Total assets | $432,317 | $371,575 | $382,256 | $411,238 | $466,866 |
| Parts and storage supplier payables | $8,045 | $13,272 | $17,824 | $21,876 | $25,129 |
| Bank loan | $200,000 | $174,913 | $146,992 | $115,917 | $81,332 |
| Paid-in capital | $365,000 | $365,000 | $365,000 | $365,000 | $365,000 |
| Retained earnings | ($140,728) | ($181,610) | ($147,559) | ($91,555) | ($4,595) |
| Total liabilities and equity | $432,317 | $371,575 | $382,256 | $411,238 | $466,866 |
Margins, break-even and loan cover
| Measure | Year 1 | Year 2 | Year 3 | Year 4 | Year 5 |
|---|---|---|---|---|---|
| EBITDA margin | -5.1% | 2.0% | 7.4% | 10.0% | 13.8% |
| Net margin (before start-up costs) | -16.1% | -4.5% | 2.8% | 6.4% | 8.5% |
| Payroll incl. pay raises as share of revenue | 54% | 54% | 51% | 47% | 46% |
| Revenue per full-time equivalent at year end | $138,035 | $182,160 | $203,870 | $214,473 | $246,366 |
| Average monthly revenue | $46,012 | $75,900 | $101,935 | $125,109 | $143,713 |
| Monthly revenue needed to cover operating costs | $48,992 | $73,944 | $92,347 | $109,281 | $118,498 |
| Debt service cover (EBITDA / interest + principal) | -1.3x | 0.4x | 2.0x | 3.3x | 5.2x |
In 2027 average monthly revenue of $46,012 falls short of the $48,992 needed to cover operating costs. Year 2 clears the bar, with $75,900 against $73,944, yet it still posts a loss because depreciation and interest sit below the operating line. The same gap shows in loan cover: EBITDA of $18,478 in Year 2 covers about 40% of the $45,375 of interest and principal, and the reserve pays the rest. Cover reaches 2.0x in Year 3 and 5.2x in Year 5, so a lender would reasonably test covenants from Year 3 and not before.
If revenue comes in 20% short
| Year 1 | Year 2 | Year 3 | Year 4 | Year 5 | |
|---|---|---|---|---|---|
| Revenue | $441,712 | $728,639 | $978,574 | $1,201,046 | $1,379,649 |
| Net income before start-up costs | ($141,793) | ($100,540) | $13,817 | $21,979 | $130,343 |
| Net income after start-up costs | ($193,793) | ($100,540) | $13,817 | $21,979 | $130,343 |
| Closing cash | $149,012 | $36,950 | $39,700 | $49,898 | $160,350 |
Every revenue line is 20% below the base case in all five years. Daniel's response has seven parts: his own pay falls 20% to $84,000 and stays there for the whole model, marketing falls 20%, the second recovery engineer and the support technician start twelve months later than planned (months 32 and 38), the second senior examiner is never hired, equipment replacement is cut in half, the firm stays in its first lab instead of moving in Year 4, and no distributions are paid. The examiner and systems engineer still start in months 7 and 11, since the work they cover is already in the pipeline. With those in place the firm loses money in 2027 and 2028 and earns a profit from Year 3. Net income is lower than the base case in every year. Year-end cash never falls below $36,950, reached at the end of Year 2, and equity at the end of Year 1 is $171,207. The Year 5 margin of 9.4% looks better than the base case's 8.5% only because the pay cut, the unfilled senior post and the smaller lab remove costs; profit in dollars is still lower. Restoring Daniel's full salary from Year 4 would take about $29,000 a year off the downside profit before tax. The annual view hides month-to-month swings, so Year 2's real low point sits below the $36,950 year-end figure, and the firm would arrange an overdraft line with the bank before it needed one.
Sources
- Florida Legislature, Florida Statutes section 501.171, Florida Information Protection Act: service-provider notice to the covered entity within 10 days; individual notice within 30 days; notice to the Department of Legal Affairs for breaches affecting 500 or more people in Florida. Statutes are amended, so counsel confirms the current text.
- Florida Legislature, Chapter 493, Private Investigative, Recovery, and Security Services: cited for the existence of the licensing regime; its application to forensic work is a question for counsel.
- Florida Department of Revenue, Corporate income tax: 5.5% rate. The rate may change.
- National Hurricane Center, Climatology: Atlantic hurricane season runs June 1 to November 30.
- NIST, Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response: practical guidance on forensic processes, written from an IT view rather than a law-enforcement view.
Create a plan as complete as this one
Pick the amount of help you want.
Do it yourself
$197 Toolkit, 12 months
Build your plan with the AI Wizard and every tool you need, at your own pace.
Start my plan →Done with you
$497 Toolkit Plus, 12 months
Our AI builds the plan with you, section by section, from your answers.
Want a person too? Upgrade to a consultation with an MBA graduate.
See Toolkit Plus →Done for you
From $1,997 written for you
We research and write the whole plan, and you review the finished draft.
See the writing service →Ready to write yours? Open the data recovery services business plan template, fill in your figures and export it.