Forensics, eDiscovery and expert witnesses
Digital Forensics & eDiscovery
Computer, mobile device, email and cloud forensics for businesses and attorneys. GDF also provides eDiscovery collections, expert reports and testimony.
Gather records before an engagement
Related preparation packages
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export-control specialist.
These are preparation aids. They do not replace an audit, assessment, legal opinion or specialist decision, and they do not authorize testing.
Read the overviews without a form. Downloads require your name and email; we email a seven-day access link. Organization and phone are optional.
Departed-employee data sources
Identify devices, mail, cloud storage, archives, backups and logs to discuss with counsel and client IT.
File: ZIP: source guide, checklists and sample questions.
Commercial and contract dispute data sources
Locate contracts, messages, collaboration records and business-system data, with questions for counsel and system owners.
File: ZIP: source guide, checklists and sample questions.
Medical-matter data sources
Identify records in EMRs, practice systems, portals and logs, then document custodians, retention and access questions.
File: ZIP: source guide, checklists and sample questions.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
See All services
Find a forensic service
Choose the service you need.
eDiscovery and expert services
Discuss your matter and deadline
Describe the issue, relevant people and systems, and anything about to be wiped, reassigned or deleted. Discuss authorization and preservation before sharing source material.
The principal services below provide starting points for an examination, expert testimony, eDiscovery or an employee matter. A connected assignment may involve more than one.
Principal services
Forensics, eDiscovery and expert witnesses
Choose forensics for a business investigation, eDiscovery for collecting and preparing records, or an expert witness for a technical dispute.
Computer forensics
Examine computers, drives and related records to reconstruct activity, evaluate deletion and explain disputed facts. Correlate technical traces with email, cloud and account records instead of treating one artifact as proof of intent.
Explore computer and digital forensicsExpert witnesses
Match the disputed technology to relevant examination experience. Discuss scope, potential conflicts, reports, opposing-expert review, deposition and testimony. Findings identify their supporting records, methods and limits; the court decides admissibility.
Find the relevant expert specialtyeDiscovery collections and processing
Plan collection, processing, hosting and production around counsel's requests, the available sources and the client's resources. Define custodians, dates, search terms and delivery requirements before unnecessary material enters review.
Plan the discovery workflowEmployee and trade-secret matters
Preserve an employee's devices and accounts before reassignment or routine cleanup. Examine file movement, removable devices, email and cloud activity to establish what the available record shows about company information and a departure.
Explore employee and trade-secret forensicsBefore collection
Preserving computers, phones and accounts
Plan preservation and examination together. A large collection can still miss the account or log that matters.
Consider the connected record
A phone may hold application activity while related Apple, Google or Samsung accounts hold synchronized content and backups. Microsoft 365 or Google Workspace can hold email, shared files, permissions and available activity logs beyond one mailbox.
Access, retention, encryption and the condition of each source affect what can be collected. Screenshots may help preserve an otherwise inaccessible conversation, but they do not replace all the context or metadata that a source examination can provide.
Compare mobile collection methodsKnow what the findings establish
Depending on the engagement, deliverables can include acquisition and custody records, findings, a sourced timeline, relevant files and exhibits. The report separates observed activity from interpretation and states missing sources or unresolved questions.
Permission to access a file is not proof that someone read or copied it. Deleted content is not always recoverable. Those limits belong in the explanation counsel and business leaders receive.
Understand transfer and exfiltration evidenceSpecialist routes
Browse all forensic services
Find services for devices and accounts, expert testimony, eDiscovery and media authentication.
Device, email and cloud evidence
Choose the sources involved. A phone, mailbox and cloud account can contain different parts of the same record.
Expertise for the disputed technology
The specialist pages explain the evidence, examination questions and limits relevant to each type of dispute.
Preservation, review and production
Follow the stage your matter has reached, from identifying sources to preparing agreed production files.
Authentication and specialized records
Some questions concern the authenticity of media, the operation of a database or the way an identity system stores information.
Additional service routes
Additional forensic services
Find additional services for business records, connected devices, employee departures and technical disputes.
Computers, databases and business records
Follow a particular storage source, business system or mixed-source examination. These routes provide more detail than the general computer-forensics starting point.
Connected devices and embedded systems
A connected product can leave evidence in the device, companion applications and associated systems. Choose the relevant device family to discuss the available sources.
Employee and business departures
Choose a departure-focused engagement when the immediate need is preserving the record and answering defined questions about an exit or separation.
Discovery planning, sources and review
These routes address the working relationship, source type or review environment. They support the collection-to-production workflow rather than replacing its individual stages.
Technology testimony and neutral examination
Use these specialist routes for disputed technical behavior or an agreed neutral examination. Scope and expert selection depend on the questions and evidence in the matter.
Incident evidence and preservation readiness
An incident may involve business systems, personal information or industrial records. Preserve the relevant sources and agree on the technical questions before routine changes erase useful activity.
Experience and methods
Our experts and case studies
Relevant qualifications and specific work help counsel assess fit. A prior engagement or court qualification does not guarantee a result in a new matter.
Meet the examiners
The published biographies describe the team's technical experience, qualifications and selected matter experience.
Read two case histories
COMLAB v. Kal Tire describes examination of disputed email, document metadata and a claimed computer-virus explanation.
Rogers v. BNSF Railway describes GDF's database and forensic work concerning biometric identity records. The case history distinguishes the trial judgment from the later settlement.
Browse the case studiesRelated cybersecurity services
An incident can require both preserved evidence and an assessment of the access path. Coordinate response and examination before remediation changes the records you need.
Explore Enterprise CybersecurityBefore you contact us
Describe the issue, relevant people and sources, preservation risks and deadline. Keep the first summary non-sensitive. Arrange a secure channel before sharing evidence, credentials or confidential documents.
For work across locations, review our regional engagement information and discuss the sources and timing at each site.
For an active incident, call. A form submission does not create an engagement.
Choose the evidence work and first output
Start with the question and the records already available. The appropriate work depends on authority, source access, retention and the decision the evidence must support.
- Examination: preserve and interpret supported device, email or cloud records; receive an acquisition record, source-linked findings and technical limits.
- Recovery: assess damaged, deleted or inaccessible material; receive recovered records where feasible and an explanation of unavailable data.
- eDiscovery: define custodians, sources, date range and production requirements; receive a reconciled collection or delivery manifest with exceptions.
- Expert testimony: identify the disputed proposition and disclosure requirements with counsel; receive a scoped report or opinion workpaper from the relevant qualified expert.
An illustrative workpaper can tie a claimed transfer to an email attachment, account event and file artifact, while identifying clock differences and alternative explanations. A matching hash establishes file integrity, not the author or intent. Request a suitable sample and the proposed examiner's relevant qualifications during scoping.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts