Digital Forensics, Expert Testimony and Cybersecurity Since 1992

Court Qualified Digital Forensics and Cybersecurity Experts

Disputes, departures and security decisions now turn on records held in computers, phones, mailboxes, cloud accounts and industrial systems. Global Digital Forensics examines those systems, establishes what the records actually show and explains it in reports and testimony that judges, juries and boards can act on. Founded in 1992, the firm works from sixteen US offices behind one 24/7 hotline, and its examiners have testified in federal and state courts.

Boardroom table prepared for a technical briefing.

The firm

An Engineering Practice That Answers to Courts

Global Digital Forensics was founded in 1992, when digital evidence still lived in server rooms. It now lives in every pocket, mailbox and cloud tenant, and the practice has followed it there. The discipline has not changed: examine the system, find what the records actually show and explain it in terms a decision maker can act on.

Law firms bring us in when the facts of a dispute sit on devices and accounts. Technology leaders bring us in when they need an independent read on the systems they depend on, from enterprise networks to SCADA, OT and AI deployments. Both receive the same standard of evidence, because the examiner who walks a board through a breach on Tuesday may be walking a jury through a timeline on Thursday. That is why AmLaw 100 firms and Fortune 1000 companies have relied on the firm for both.

Today the practice covers digital forensics and expert witness engagements, eDiscovery, biometrics and identity sciences, critical infrastructure and OT security, cyber due diligence, executive cyber risk advisory, and AI and deepfake analysis. Sorting out which of those your matter needs is the first thing we do together: describe the evidence and the deadline, and a senior examiner will tell you who should take the call.

People

The Examiners Who Take the Stand

Three of the practitioners whose work carries the firm's findings into depositions, courtrooms and boardrooms, with the credentials and court experience each one brings.

Joseph Caruso

Founder, CEO and CTO

Joseph Caruso is the founder, CEO and CTO of Global Digital Forensics. His technology career began in 1980 and spans software development, mainframe databases, real time transaction systems, mobile devices, cellular networks and cybersecurity incident response. That engineering background informs his examination of how systems work, where evidence is stored and what the available records can establish.

Joseph supports attorneys in technology disputes involving source code, databases, digital evidence and complex business systems. His experience includes IBM mainframe environments, mobile operating systems and the analysis of security incidents. He explains technical methods and findings in terms that attorneys and other decision makers can evaluate.

His consulting expert experience includes Motorola Mobility v. Microsoft and Apple v. Samsung patent litigation. His work in an American Express consumer class action involved airline reservation architecture, real time transactions, mainframe databases, source code and system configuration. His Bank One shareholder class action work involved credit card transaction and deposit systems.

Education

Joseph holds a dual BA/BS in mathematics and engineering physics from Stevens Institute of Technology.

Certifications and technical training

  • Certified Information Systems Security Professional (CISSP), ISC2.
  • Certified Forensic Examiner.
  • Training in EnCase Enterprise, AccessData and open source forensic tools.

Selected case experience

  • Rogers v. BNSF Railway: biometric information litigation.
  • Motorola Mobility v. Microsoft and Apple v. Samsung: consulting expert work involving mobile technology.
  • American Express consumer class action: analysis of reservation systems, mainframe databases and source code.
  • Bank One shareholder litigation: analysis of credit card transaction and deposit systems.
Discuss a technical dispute

Veronica Perez

Senior Computer Forensic Specialist

Veronica Perez is a Senior Computer Forensic Specialist whose work focuses on the collection, preservation and examination of mobile device evidence. Her experience covers laboratory and field examinations, location artifacts, vehicle systems and electronic records used in litigation.

Before her private sector work, Veronica served with the Los Angeles School Police Department from 2001 to 2007 and the West Covina Police Department from 2007 to 2016. That experience informs her approach to evidence custody, documentation and forensic analysis. She has provided mobile forensics instruction for the California Department of Justice Advanced Training Center and Teel Technologies, including practical assistance to examiners handling difficult acquisitions.

Her technical background includes developing utilities for processing mobile data and training in JTAG, chip off, in system programming, vehicle forensics, microsoldering and embedded hardware analysis. She helps attorneys evaluate device evidence, plan collections and understand the capabilities and limitations of the available methods.

Certifications and technical training

  • EnCase Certified Examiner (EnCE), Guidance Software, listed in 2009.
  • Paraben Certified Mobile Phone Examiner (CME), listed in 2008.
  • Cellebrite CCLO/CCPA, listed in 2014.
  • California Department of Justice training in computer crime examinations and cell phone forensics, with instructor experience beginning in 2012.
  • Teel Technologies training in JTAG, chip off, in system programming, vehicle forensics and embedded hardware analysis.
  • Oxygen Forensics Bootcamp (2023) and iPadRehab microsoldering training (2024).

Court and matter experience

Veronica has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago. Her work for attorneys, law enforcement agencies, corporations and insurers includes fraud, intellectual property theft, trade secret disputes, employee disputes, patent and copyright matters, family law and breach of contract matters. Her examinations include mobile communications, application activity and location records.

Discuss device evidence

Robert Knudsen

Computer Forensics and Cybersecurity Specialist

Robert Knudsen, also known as Bob, is a computer forensics and cybersecurity specialist. He has 18 years of forensic experience and hundreds of computer and mobile device examinations supporting matters in federal and state courts throughout the United States.

Before entering computer forensics, Bob spent four years supporting computer and network operations as a field technician and manager. He previously served for twenty years with the New York City Police Department, where his work included designing and deploying a database for compiling crime statistics.

His background brings together practical knowledge of business systems, digital examinations and law enforcement documentation. His listed qualifications include the Certified Computer Examiner credential and training or certifications covering information security, forensic examination, networking and endpoint security.

Certifications

  • Certified Information Systems Security Professional (CISSP), ISC2.
  • Certified Computer Examiner (CCE), International Society of Forensic Computer Examiners (ISFCE).
  • Computer Hacking Forensic Investigator (CHFI), EC-Council.
  • CompTIA Security+, Network+ and A+.
  • Stellar Cyber Certified Associate.
  • Microsoft Certified Professional and Microsoft Office User Specialist (MOUS).

His additional training includes OpenEDR through Xcitium Academy.

Court and examination experience

Bob has conducted hundreds of computer and mobile device examinations supporting federal and state court matters across the United States. His experience combines forensic examination with hands on support of business computer and network environments and twenty years of NYPD service.

Discuss an examination

Ask for a current CV and the experience relevant to your matter. We confirm the expert and their availability while scoping, and the examiner who does the work is the examiner who explains it.

Match an Examiner to Your Matter

Tell us about the evidence, the technical question and the deadline. On the first call a senior examiner will recommend the practitioner whose experience fits and send the CV you need for disclosure.

Get a Free Consultation

Standards

Credentials Behind Every Engagement

  • Court qualified expert witnesses

    Examiners who have testified in federal and state courts and been deposed and cross examined in civil and criminal matters.

  • Certified forensic examiners

    Practitioners holding recognized digital forensic examiner certifications and vendor tool certifications for the platforms used in acquisition and analysis.

  • Biometrics and identity science

    We examine biometric scanners, the applications that use them and the databases that store templates and images, showing how identity data was collected, used, protected or exposed.

  • Documented methodology

    Written acquisition, hashing, chain of custody and reporting procedures applied to every engagement and produced on request.

  • Reports built for the forum

    Analysis and reporting that follow accepted forensic practice and the framework the court, regulator or auditor applies to the matter.

  • Controlled handling of client material

    Requests and engagements are handled in confidence, and published case studies describe experience without naming confidential clients.

Every engagement record identifies the examiner, the methodology and the credentials relevant to the matter, and supporting credential evidence is available during scoping and expert qualification.

Coverage

Sixteen US Offices, an International Line and One Hotline

Every office is reachable through the 24/7 hotline, (800) 868-8189, and callers outside the United States can use the international line, +1 (727) 287-6000. Tell us where the evidence and the systems sit, and the first call will settle who collects it and how.

Working with us

Partnership Program for Firms That Keep the Client Relationship

Law firms, insurers, breach coaches, managed service providers and consultancies bring GDF in as the forensic, deepfake and critical infrastructure capability behind their own engagements. They keep the client relationship; we supply the examiners, the methodology and, when the matter calls for it, the testimony.

Discuss the partnership program

Knowledge transfer

Training Taught by the Examiners Who Do the Work

We deliver practitioner and executive training on digital evidence handling, incident readiness and operational technology security, from courtroom focused evidence workshops for litigation teams to tabletop exercises for utility and board audiences, taught by the examiners who do the work.

Discuss training

Firm background

How the Practice Was Built and Shared

The firm grew by doing the examinations itself, teaching the method to others and extending its bench through partners who work under its methodology.

How the practice was built

Evidence analysis, security testing and expert testimony grew up under one roof rather than through acquisitions, so the people who collect the evidence are the same people who explain it and stand behind it.

Training that is vendor neutral

Our computer forensics and electronic discovery curriculum teaches examination by hand before tooling: the history behind current procedure, disk and file system storage including FAT and NTFS structures, recovery from slack and unallocated space, and the accepted principles that keep an examination defensible. The course emphasizes explaining and checking results rather than trusting one vendor's product, which is also how we work on your matter.

How partners bring GDF into their own engagements

Qualified forensic and security practitioners can deliver work locally under the firm's engagement, methodology and management, with no quotas and no participation fees. Because partners are trusted with confidential client matters, final applicants are background checked.

Anyone comparing firms can read the examination process we follow and test the method against the matter before calling.

Who Does the Work, and How It Is Arranged

The question that matters at deposition is who performed the examination, so every engagement names that person, the qualifications that fit the evidence and any specialist who joins the work. For an examination we agree on the question the evidence must answer, how the sources will be accessed and preserved, and what the written report will contain before any material changes hands. For testimony, counsel receives the proposed expert's current CV, relevant experience and what disclosure will require.

For an onsite collection we confirm the appointment, the receiving person, the location, the transport and the chain of custody before anyone travels. When a partner delivers part of the work, we name the qualified participant and who signs the report.

Find the nearest GDF office · Browse the forensic specialties

Free initial consultation

Put a Court Qualified Examiner on Your Matter

On the first call a senior examiner will listen to what happened, tell you what the evidence can likely answer and who should do the work, and arrange a secure way to share material. The consultation is free and handled in confidence.

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .

Privacy center

Choose your site settings

Optional technology stays off until you choose otherwise. You can change these browser settings at any time. Access to the core site does not depend on optional technologies.

Technology preferences
Sale or cross-context sharing: not used GDF does not sell or share website personal information for cross-context behavioral advertising.