DIGITAL FORENSICS, EXPERT WITNESS TESTIMONY, AND CYBERSECURITY
Since 1992, litigation counsel, CISOs, and risk executives have retained Global Digital Forensics when high stakes matters turn on digital evidence across computers, mobile devices, and cloud tenants, or when critical networks require adversarial testing. Our certified examiners uncover the technical facts, document every artifact to courtroom standards, and defend their findings under oath.
Court tested examiners. Sixteen US offices. One hotline, answered 24/7. New to this? See how a forensic examination runs, from preservation to testimony.
Someone deleted the files, took the client list or disputes what an email says. We preserve computers, phones, email and cloud accounts, recover what was hidden and deliver findings your legal team can put in front of a judge.
Explore forensic and litigation servicesYour network, applications, industrial controls or AI systems need to be tested before an attacker does it for you, or an incident is already underway and you need answers tonight. We test, assess and respond with the same evidence discipline we bring to court.
Explore cybersecurity servicesTwo kinds of clients
For businesses and counsel
Counsel and business owners come to us when the facts live in devices and accounts: a departing executive who copied the deal pipeline, an email that may have been altered, a partner who disputes what was agreed. We image and preserve the sources first so nothing is lost, reconstruct the activity across every device and account, and explain the result in plain English. When the matter needs testimony, the examiner who did the work takes the stand.
For business and technology leaders
Executives and technology leaders come to us to find the weaknesses before an attacker does and to get a straight answer when something has already gone wrong. We test networks, applications, industrial control systems and AI deployments against the way real intrusions happen, then rank what we find by business consequence so your team fixes the right things first. Every finding is documented to the standard we use in court, which means your board, your insurer and your regulator can rely on it.
Explore cybersecurity servicesHow the work is done
Every engagement follows the same three stages because that is what survives cross examination. We preserve first, creating forensic images and authorized exports with verified hash values and a documented chain of custody, so opposing counsel cannot argue the evidence changed in our hands. We examine next, recovering deleted and hidden records and correlating activity across computers, phones, email and cloud accounts into one verified timeline, because a single timestamp rarely tells the story and an inexperienced reviewer can mistake routine synchronization for misconduct. We explain last, in a written report, demonstrative exhibits and testimony that a judge, a jury or a board can follow without a technical background. Where standard tools stop, our examiners build the method the evidence requires and document it so another expert can repeat it.
Proven results
$228 million biometric privacy judgment
In Rogers v. BNSF Railway, the first Illinois biometric privacy class action to reach a jury, GDF served as the database, data analysis and computer forensics experts for plaintiffs’ counsel. The jury found 45,600 violations and the court entered a $228 million judgment. The damages award was later vacated for a retrial on damages alone, and the parties then agreed a $75 million settlement fund.
Read the public record case studyTen years of trading records rebuilt
When teams of lawyers and financial experts could not make sense of a decade of brokerage statements in a massive securities fraud, GDF located the clearing firm database, caught an export error that had silently corrupted the data and rebuilt ten years of trades across several hundred securities so counsel and their industry experts could evaluate the fraud and the damages.
Read the case studyEncrypted evidence recovered for prosecutors
Seized computers in a pharmaceutical diversion case were encrypted, in a foreign language and stuck behind a backlogged government lab while the diversion continued. GDF examiners decrypted and examined the systems and supplied the recovered email, purchase and shipping records to the prosecuting authorities alongside the physical evidence, so the case could move forward without waiting months for a lab slot.
Read the case studyFederal court credibility finding
In COMLAB v. Kal Tire, Joseph Caruso showed from document metadata that the opposing party’s emails had been fabricated. The Southern District of New York called his testimony reasonable, logical, and ultimately highly credible, found fabrication and spoliation by clear and convincing evidence and dismissed the case with prejudice.
Read the public record case studyRecover deleted files, trace USB and cloud transfers and connect computer, email and cloud records into one timeline that shows exactly what happened and when.
Put an examiner on the stand who has been accepted by federal and state courts, with reports and exhibits written for judges and juries rather than for other engineers.
Collect, process and produce electronically stored information to your ESI agreement, using GDF built tools that cut review volume instead of inflating it.
Find the attack paths a real intruder would use across your networks and applications, then get remediation priorities ranked by consequence to the business.
Assess industrial control and SCADA environments with your engineering team, using methods planned around safety and uptime rather than office network assumptions.
Examine how your AI systems are built, governed and attacked so leaders can deploy them with the risks understood and controlled.
The people behind the findings
Joseph Caruso, our founder, CEO and CTO, holds the CISSP, began his technology career in 1980 and has examined source code, databases and complex business systems for counsel in matters including Motorola Mobility v. Microsoft and Apple v. Samsung. Veronica Perez, an EnCase and Cellebrite certified examiner with fifteen years of police service, has been designated a digital forensics expert in California, Oklahoma and South Carolina superior courts and in federal court in Chicago. Robert Knudsen combines the CISSP and Certified Computer Examiner credentials with eighteen years of forensic casework and twenty years with the New York City Police Department. The examiner who does the work is the examiner who explains it.
Meet the forensic experts Discuss your matterGDF owns its software. eCloudDiscovery, CompleteDiscovery, Forensic Media Analyzer, DeSpy, SourceScan, Bitstream Superhighway and DataTube are built and maintained by GDF, which is why we can offer cost effective eDiscovery processing and hosting scaled to small and midsize businesses as well as to national firms.
Explore GDF softwareIf an incident is possible rather than present, an incident response retainer puts our team on call before you need it. Our technical guides explain the methods in plain English, and our locations page shows the sixteen US offices and international line that let us collect evidence wherever the matter is.
Talk with an examiner today
The first consultation is free. Tell us what happened, what is at stake and when you need answers, and a senior examiner will tell you what can be recovered, what it will take and how we would present it. We will arrange a secure way to share material, so please do not send evidence or credentials by email.
Our 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .