Digital Forensics, Expert Testimony, eDiscovery and Penetration Testing
When a lawsuit, a departure or a breach turns on what a computer, phone, mailbox or network actually recorded, opinion is not enough. Global Digital Forensics preserves and examines that evidence, rebuilds the timeline, and tests your systems the way a real intruder would, so counsel and security leaders know what happened and what an attacker can reach. Our examiners document every step to courtroom standards and have testified in federal and state courts, and our operators validate every attack path by hand.
Two practices
A file was deleted, a client list walked out the door, or the other side disputes what an email says. We preserve computers, phones, email and cloud accounts, recover what was removed and deliver the report and testimony your trial team will use.
Explore forensic and litigation servicesYou need to know what an intruder could reach before one tries, or an incident is already underway. We test networks, applications, industrial controls and AI systems, respond to breaches around the clock and write up every finding to the standard we use in court.
Explore cybersecurity servicesOn the record
Four published matters show what the work looks like when it reaches a courtroom, a prosecutor or a damages expert.
$228 million biometric privacy judgment
In Rogers v. BNSF Railway, the first Illinois biometric privacy class action to reach a jury, GDF served as the database, data analysis and computer forensics experts for plaintiffs’ counsel. The jury found 45,600 violations and the court entered a $228 million judgment. The damages award was later vacated for a retrial on damages alone, and the parties then agreed a $75 million settlement fund.
Read the public record case studyTen years of trading records rebuilt
When teams of lawyers and financial experts could not make sense of a decade of brokerage statements in a massive securities fraud, GDF located the clearing firm database, caught an export error that had silently corrupted the data and rebuilt ten years of trades across several hundred securities so counsel and their industry experts could evaluate the fraud and the damages.
Read the case studyEncrypted evidence recovered for prosecutors
Seized computers in a pharmaceutical diversion case were encrypted, in a foreign language and stuck behind a backlogged government lab while the diversion continued. GDF examiners decrypted and examined the systems and supplied the recovered email, purchase and shipping records to the prosecuting authorities alongside the physical evidence, so the case could move forward without waiting for the lab.
Read the case studyFederal court credibility finding
In COMLAB v. Kal Tire, Joseph Caruso showed from document metadata that the opposing party’s emails had been fabricated. The Southern District of New York called his testimony reasonable, logical, and ultimately highly credible, found fabrication and spoliation by clear and convincing evidence and dismissed the case with prejudice.
Read the public record case studyMethod
01 / Preserve. We image computers, phones, mailboxes and cloud tenants with forensic acquisition tools, verify every copy with a cryptographic hash and open the chain of custody record before anyone analyzes a byte. An opposing expert can repeat every step of the collection and reach the same copy.
02 / Examine. Examiners recover deleted material, correlate file system, application and log artifacts, and rebuild a timeline of who did what and when. Every conclusion traces back to the artifact that supports it, so an opposing expert can repeat the work and reach the same place.
03 / Explain. Reports are written for judges, juries and boards rather than for other engineers, with exhibits that show the record instead of describing it. The examiner who did the analysis is the one who defends it at deposition and trial.
Tell us what the evidence needs to show and book a free consultation; the first call covers what should be preserved today, what an examination would answer and how long it would take.
Who relies on us
For litigation partners and general counsel
You get an examiner who identifies the sources that matter, preserves them defensibly and turns raw artifacts into a written report, trial exhibits and testimony built to withstand cross examination. Collections and processing run on software GDF owns, so eDiscovery scales to the size of the matter rather than to a vendor's rate card.
For CISOs and engineering directors
You get senior operators who chain real exposures together the way an intruder would, rank what they find by business consequence and retest your fixes once they are in place. When something has already gone wrong, our incident responders work from the 24/7 hotline to contain it and preserve the evidence your insurer, your regulator and your counsel will ask for.
Explore cybersecurity servicesSpecialties
Recover deleted files, trace USB and cloud transfers, and join computer, email and cloud records into one timeline that shows what happened and when.
Put an examiner on the stand who has testified in federal and state courts, with reports and exhibits written for judges and juries rather than for engineers.
Collect, process and produce electronically stored information to your ESI protocol on GDF owned processing and hosting, scaled to the size of the matter.
See the attack paths a real intruder would chain across your networks and applications, with remediation ranked by consequence to the business.
Assess industrial control and SCADA environments alongside your engineers, with testing planned around safety, uptime and maintenance windows.
Test how your AI systems are built, governed and attacked, from prompt injection to data leakage, before you put them in front of customers.
Leadership
Joseph Caruso, our founder, CEO and CTO, began his technology career in 1980, holds the CISSP and served as a consulting expert in the Motorola Mobility v. Microsoft and Apple v. Samsung patent litigation. Veronica Perez, an EnCase and Cellebrite certified examiner who spent fifteen years in police service, has been designated a digital forensics expert witness in California, Oklahoma and South Carolina superior courts and in federal court in Chicago. Robert Knudsen pairs the CISSP and Certified Computer Examiner credentials with eighteen years of forensic casework and twenty years with the New York City Police Department. The person who examines your evidence is the person who explains it.
Meet the forensic experts Discuss your matter with an examinerGDF owns its software. eCloudDiscovery, CompleteDiscovery, Forensic Media Analyzer, DeSpy, SourceScan, Bitstream Superhighway and DataTube are built and maintained in house, which is why we can offer cost effective eDiscovery processing and hosting to small and midsize businesses as well as to national firms.
Explore GDF softwareIf an incident is possible rather than present, an incident response retainer puts our team on call before you need it. Our technical guides explain the methods in plain English, and the GDF office locations page lists the sixteen US offices and the international line that let us collect evidence wherever the matter is.
Free initial consultation
Tell us what happened, what is at stake and when you need answers. On the first call a senior examiner or security lead will tell you what can be recovered or tested, how long it will take and how the findings would be presented, then arrange a secure way to share material. The consultation is free and handled in confidence.
Our 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .