Evidence for business decisions and litigation
GDF preserves and examines digital records for businesses and counsel. We connect activity across devices, accounts and systems, explain the findings, and support expert reports and testimony when the matter requires them.
Principal services
Begin with the problem, then follow the relevant evidence or discovery stage. The services below also apply to business matters before litigation begins.
Examine computers, drives and related records to reconstruct activity, evaluate deletion and explain disputed facts. Correlate technical traces with email, cloud and account records instead of treating one artifact as proof of intent.
Explore computer and digital forensicsMatch the disputed technology to relevant examination experience. Discuss scope, potential conflicts, reports, opposing-expert review, deposition and testimony. Findings identify their supporting records, methods and limits; the court decides admissibility.
Find the relevant expert specialtyPlan collection, processing, hosting and production around counsel's requests, the available sources and the client's resources. Define custodians, dates, search terms and delivery requirements before unnecessary material enters review.
Plan the discovery workflowPreserve an employee's devices and accounts before reassignment or routine cleanup. Examine file movement, removable devices, email and cloud activity to establish what the available record shows about company information and a departure.
Explore employee and trade-secret forensicsBefore collection
Preservation and examination scope belong together. A large collection can still miss the account or log that matters.
A phone may hold application activity while related Apple, Google or Samsung accounts hold synchronized content and backups. Microsoft 365 or Google Workspace can hold email, shared files, permissions and available activity logs beyond one mailbox.
Access, retention, encryption and the condition of each source affect what can be collected. Screenshots may help preserve an otherwise inaccessible conversation, but they do not replace all the context or metadata that a source examination can provide.
Compare mobile collection methodsDepending on the engagement, deliverables can include acquisition and custody records, findings, a sourced timeline, relevant files and exhibits. The report separates observed activity from interpretation and states missing sources or unresolved questions.
Permission to access a file is not proof that someone read or copied it. Deleted content is not always recoverable. Those limits belong in the explanation counsel and business leaders receive.
Understand transfer and exfiltration evidenceSpecialist routes
Use these service pages for a specific source, technical dispute or stage of the matter. If several apply, we can scope the connected work together.
Choose the sources involved. A phone, mailbox and cloud account can contain different parts of the same record.
The specialist pages explain the evidence, examination questions and limits relevant to each type of dispute.
Follow the stage your matter has reached, from identifying sources to preparing agreed production files.
Some questions concern the authenticity of media, the operation of a database or the way an identity system stores information.
Additional service routes
The principal choices above provide a starting point. Use the groups below when the source, departure, discovery need or disputed technology is already known.
Follow a particular storage source, business system or mixed-source examination. These routes provide more detail than the general computer-forensics starting point.
A connected product can leave evidence in the device, companion applications and associated systems. Choose the relevant device family to discuss the available sources.
Choose a departure-focused engagement when the immediate need is preserving the record and answering defined questions about an exit or separation.
These routes address the working relationship, source type or review environment. They support the collection-to-production workflow rather than replacing its individual stages.
Use these specialist routes for disputed technical behavior or an agreed neutral examination. Scope and expert selection depend on the questions and evidence in the matter.
An incident may involve business systems, personal information or industrial records. Preserve the relevant sources and agree on the technical questions before routine changes erase useful activity.
Experience and methods
Relevant qualifications and specific work help counsel assess fit. A prior engagement or court qualification does not guarantee a result in a new matter.
The published biographies describe the team's technical experience, qualifications and selected matter experience.
COMLAB v. Kal Tire describes examination of disputed email, document metadata and a claimed computer-virus explanation.
Rogers v. BNSF Railway describes GDF's database and forensic work concerning biometric identity records. The case history distinguishes the trial judgment from the later settlement.
Browse the case studiesAn incident can require both preserved evidence and an assessment of the access path. Coordinate response and examination before remediation changes the records you need.
Explore Enterprise CybersecurityDescribe the issue, relevant people and sources, preservation risks and deadline. Keep the first summary non-sensitive. Arrange a secure channel before sharing evidence, credentials or confidential documents.
For work across locations, review our regional engagement information and discuss the sources and timing at each site.
For an active incident, call. A form submission does not create an engagement.
Talk with an examiner
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts