Answers for attorneys and business leaders
Digital Forensics FAQ
Need to preserve evidence, understand an employee departure or prepare for testimony? Start with these practical answers about digital forensic services and the work GDF delivers.
What digital forensics can establish
Digital forensics preserves and examines information from computers, mobile devices, email and cloud systems. GDF correlates available file activity, messages, sign-ins and sharing records to test what happened and explain the supporting evidence and gaps.
A useful examination begins with a business or case question. That question guides the sources we collect, the time period we examine and the report we prepare. Our computer, email and cloud forensic service brings those sources together.
What happens after you contact GDF
- Discuss the matter. Tell us the question, relevant people and organizations, devices or accounts, and deadline.
- Agree on scope and cost. We explain collection, analysis and reporting options, including the flat-rate Core Analysis service for an agreed departure review.
- Preserve and examine. We coordinate access, collect evidence using documented procedures, verify integrity and analyze the relevant activity.
- Use the findings. Receive an understandable report, supporting records and the expert or discovery assistance your matter needs.
Discuss your evidence and case needs
Tell us what happened and which devices or accounts may hold the answer. We can explain collection options and the next step.
Evidence preservation and clear reporting
Professional collection retains original messages, attachments, file information and relevant logs together with a record of their handling. Chain of custody identifies the source and transfer history; integrity checks help establish that collected data has been preserved.
The report connects each finding to its supporting evidence. A timeline can show a file being created, attached to an email and shared through cloud storage. Counsel receives an explanation that can be used in a client discussion, discovery review, deposition or testimony.
For background on digital-evidence handling, see the NIST guide to integrating forensic techniques. GDF applies an examination plan suited to the available evidence and assignment. For organizational authority, source and operational questions, see the organizational scoping guide.
Choose the service your matter needs
Explore Microsoft 365 email forensics, Google Workspace forensics, remote mobile collection, employee data-theft analysis and eDiscovery support. Our forensic expert profiles describe relevant experience and qualifications.
Frequently asked
Common questions
Can you collect evidence remotely?
Often, when lawful authority, supported sources and the necessary access are available. GDF plans email, cloud and supported computer or mobile collection with the authorized person and documents the method and limitations. Some devices or sources require another approach.
Can my client keep using their phone?
Some supported remote workflows let the client retain the phone, but continued use may change relevant data and collection can require a connection, access steps or a pause. The model, device state, encryption, authority and question determine the plan. Obtain handling instructions before changing or continuing to use a device that may hold evidence.
Can users keep using their email account during collection?
Routine supported remote collection may permit continued use. A hold, compromised account, provider limit or collection window can change that answer. Agree access, preservation and any restrictions for the actual account before collection begins.
Can GDF tell whether an employee took proprietary information?
An examination can identify artifacts consistent with access, copying, messaging or sharing when relevant records remain available. Missing logs, shared accounts and retention can limit personal attribution or completeness. Core Analysis offers flat-rate preservation and an activity timeline for its agreed scope; findings and recovery are not guaranteed.
Can you determine whether email is authentic or altered?
GDF can examine available original messages, headers, attachments, mailbox records and related logs. The conclusion depends on the sources and corroboration. We explain the findings and limitations rather than guarantee that every message can be authenticated.
How much does a forensic examination cost?
Cost follows the questions, sources, data volume and deliverables. We discuss those details before engagement. For employee exits, executive departures and partner separations, ask about flat-rate Core Analysis for the agreed scope.
Can you help with an eDiscovery stipulation and a limited budget?
GDF can discuss technical collection requirements, keywords, processing and production specifications with retained counsel. Scope, access, review responsibilities and hosting determine the estimate; neither a fixed saving nor a legal result is assured.
What do I receive from the examination?
The agreed deliverables can include a collection inventory, chain-of-custody records, an activity timeline, relevant data, a clear forensic report and supporting exhibits. We also provide expert reports and testimony when retained.
Can your experts explain the findings in court?
When appropriately retained and qualified for the assignment, our experts can prepare reports and provide deposition or trial testimony. The court decides qualification, admissibility and weight; an engagement does not guarantee those decisions.
How do you approach deleted information?
We assess device state, storage behavior, backups, cloud versions, retention and other sources before choosing methods. Deleted or overwritten data may be unavailable. The plan identifies feasible collection and recovery work and its limits rather than promising complete recovery.
Talk through your evidence question
Find regional collection and engagement information or meet the forensic team. Ask about the collection method and report format that fit your matter.
Discuss your evidence and case needs
Call to discuss your next step and arrange secure information sharing.