Computer, Mobile, Email and Cloud Forensics, eDiscovery and Expert Testimony
Court Qualified Digital Forensics Examiners for Complex Litigation
Litigation now turns on what a laptop, a phone or a Microsoft 365 tenant recorded, and that record starts changing the day a dispute begins. Global Digital Forensics preserves it, recovers what was deleted, rebuilds the timeline of who did what and when, and puts a certified examiner on the stand to explain it. Law firms, corporate counsel and insurers reach us through sixteen US offices and a hotline answered 24/7.
Start here
Scope the Question Before Anyone Touches the Evidence
Every engagement starts with a conversation, not a tool. Tell us about the dispute, the people involved, the devices and accounts they used and the deadline you face, and a senior examiner will tell you which records can answer the question, what must be preserved this week and what the examination would deliver. Attorneys and business owners have started that way with GDF since 1992.
What happened, and which records can prove it
We identify the question the case actually turns on, whether a file was copied, an email was altered or an account was accessed, and the computer, phone, email and cloud records that can answer it.
What your legal team will receive
Depending on the matter, that is a documented acquisition and chain of custody, a sourced timeline, recovered files and exhibits, or an expert report from the examiner who will testify to it.
What has to happen this week
Devices get reassigned, logs expire and cloud retention runs out. We tell you what to preserve immediately, how to secure authorized access and when our team needs to be on site or connected.
The full directory
Find the Forensic Service Your Matter Needs
Every forensic, eDiscovery and expert witness service we offer, grouped by the evidence involved. If your matter does not fit neatly, call (800) 868-8189 and an examiner will point you to the right specialist.
Litigation, discovery and expert testimony
A Record Built in Courtrooms Since 1992
Global Digital Forensics has examined digital evidence for law firms, corporations and insurers since 1992. Our examiners have testified in federal and state courts, our work has been accepted by courts, and our national technology practice most often serves AmLaw 100 firms and Fortune 1000 companies as well as small and midsize businesses. The examiner who preserves your evidence is the examiner who explains it.
The principal services below are the usual starting points: an examination, expert testimony, eDiscovery or a departing employee matter. Many matters need more than one, and we plan them together so the examination is already built for the courtroom.
A senior examiner can walk through the facts of your matter on a free call.
Principal services
Forensic Examination, Expert Testimony and eDiscovery From One Team
Choose forensics when you need to know what happened, eDiscovery when you need to collect and produce records, and an expert witness when a technical question will be argued in court.
Computer forensics that shows what happened on the machine
We image computers and drives, recover deleted files, trace USB and cloud transfers and reconstruct user activity, then correlate those traces with email, cloud and account records. That correlation is what separates a routine system event from deliberate human action, and it is the finding your case will turn on.
Explore computer forensicsExpert witnesses who have testified in federal and state courts
We match the disputed technology with an examiner whose experience fits it, then handle scope, conflicts, reports, rebuttal of the opposing expert, deposition and trial testimony. Every finding names the records and methods behind it, so the opinion can be prepared with confidence and defended under cross examination.
Find the right expert specialtyeDiscovery collections and processing that keep review volume down
We plan collection, processing, hosting and production around the discovery requests, the available sources and the client's budget, and we run it on software GDF owns, which is why we can offer cost effective processing and hosting from a small business dispute to a national matter. Custodians, dates, search terms and delivery requirements are settled before unnecessary material reaches review.
Plan the discovery workflowDeparting employees and trade secrets, before the laptop is wiped
Before a departing employee’s laptop is wiped or the account is handed to a replacement, we preserve it. File movement, removable devices, email and cloud activity are then examined together to establish what happened to the company’s information and when, in a report that can go into negotiations or into court.
Explore employee and trade secret forensicsIf this matches the evidence in your case, tell us what you have and we will map the next steps on the first call.
How the work runs
Preserve First, Examine Everything Connected, Then Explain It
A large collection can still miss the one account or log that decides the case. We plan preservation and examination together so that nothing is lost and nothing is read in isolation.
Connect the device to the accounts around it
A phone holds application activity, but the Apple, Google or Samsung account behind it holds synchronized content and backups. A mailbox holds messages, but Microsoft 365 or Google Workspace holds the shared files, permissions and activity logs that show what was done with them. We preserve the connected record, not just the device in hand.
Before choosing a collection method we assess access, retention, encryption and the condition of each source, because original records carry the metadata the analysis depends on. Screenshots can fill a gap when a conversation is otherwise unreachable, and the report says so when they do.
Compare mobile collection methodsA report that separates fact from inference
Depending on the engagement you receive acquisition and custody records, a sourced timeline, recovered files, exhibits and a written report that separates what was observed from what is inferred and names every source reviewed.
That discipline is deliberate. Cross examination goes first after the finding that reaches past its evidence, so every conclusion we sign is anchored to the artifact, the account event or the log entry that supports it, so the other side's expert can retrace the work and land in the same place.
Understand transfer and exfiltration evidenceSpecialist services
Browse Every Forensic Specialty
Pick the page that matches the evidence in your matter. Each one explains what we examine, how we do it and what your team receives at the end.
Phones, mailboxes and cloud accounts
A phone, a mailbox and a cloud account often hold different pieces of the same record. Start with the source you have, and we will tell you which others to preserve before they change.
An expert for the technology in dispute
When the argument is about how a system behaved, the expert must know that system. These pages describe the evidence, the technical question and the experience we bring to each kind of dispute.
Preservation, review and production
Follow the stage your matter has reached, from mapping where the data lives and issuing legal holds to collecting it, reviewing it and producing it in the format the parties agreed.
Authenticity, databases and identity systems
Some questions are about whether a recording or image is genuine, how a database actually operated or how an identity system stored biometric information. In Rogers v. BNSF Railway our database and forensic work on biometric system records supported the first Illinois biometric privacy class action to reach a jury.
Additional services
Business Records, Devices and Departures
The services below address the detailed records behind a broader examination, the connected devices that increasingly carry evidence and the engagements built for employee and partner departures.
Computers, databases and business records
Choose the storage source or business system involved. These pages cover the drive level and system level examinations behind a broader computer forensic engagement, from a single disk to a mainframe or a cryptocurrency ledger.
Connected devices and embedded systems
A vehicle, drone, wearable or smart home device leaves evidence in the device itself, in its companion applications and in the manufacturer’s systems. Choose the device family and we will discuss which of those sources can still be reached.
Employee and business departures
When an employee, executive or business partner leaves, these fixed scope engagements preserve the record and answer defined questions about the exit, including our flat rate Core Analysis options.
Discovery planning, sources and review
Choose the environment that matches your matter. These services help the legal team coordinate collection, processing and production with the people who actually hold the records, on software GDF owns and maintains.
Technology testimony and neutral examination
For disputed technical behavior or an agreed neutral examination, these pages describe the specialist expertise, the evidence and the reporting responsibilities. Our founder has served as a consulting expert in Motorola Mobility v. Microsoft and Apple v. Samsung patent litigation.
Incident evidence and preservation readiness
An incident can touch business systems, personal information and industrial control records at the same time. Preserve the relevant sources and agree on the technical questions before remediation erases the activity you will need to explain to a regulator, an insurer or a court.
The people behind the findings
Meet the Examiners Who Will Stand Behind Your Evidence
Joseph Caruso, founder, CEO and CTO, began his technology career in 1980, holds the CISSP and supports litigators in disputes over source code, databases and complex business systems, including consulting expert work in Motorola Mobility v. Microsoft and Apple v. Samsung. Veronica Perez, a senior computer forensic specialist focused on mobile evidence, holds EnCase and Cellebrite certifications and has been designated a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago. Robert Knudsen holds the CISSP and Certified Computer Examiner credentials and brings eighteen years of forensic casework, hundreds of computer and mobile device examinations in federal and state court matters and twenty years with the New York City Police Department.
Examiner biographies and court experience
Each biography sets out the examiner’s technical background, certifications and selected matter experience, which gives retaining attorneys a practical basis for expert selection and disclosure. Ask for a current CV during scoping.
Two public cases our experts helped decide
In COMLAB v. Kal Tire, Joseph Caruso showed from document metadata that the opposing party’s emails had been fabricated. The Southern District of New York called his testimony reasonable, logical, and ultimately highly credible, found fabrication and spoliation by clear and convincing evidence and dismissed the case with prejudice.
In Rogers v. BNSF Railway, the first Illinois biometric privacy class action to reach a jury, GDF served as the database, data analysis and computer forensics experts for plaintiffs’ counsel. The jury found 45,600 violations and the court entered a $228 million judgment; the damages award was later vacated for a new trial on damages, and the parties then agreed a $75 million settlement fund.
Browse the case studiesTalk it through with a senior examiner at (800) 868-8189, or send the details for a free consultation.
Match the Service to the Deliverable Your Case Needs
We plan the work around the question in dispute, the sources you are authorized to reach, the retention risks and the decision the evidence has to support. That gives your team a clear basis for choosing preservation, examination, discovery or expert testimony, and for budgeting each one.
An examination preserves and interprets the relevant device, email or cloud records and delivers an acquisition record and findings tied to their sources.
A recovery engagement works on damaged, deleted or inaccessible material and returns what can be recovered, with an account of the source condition.
An eDiscovery engagement defines custodians, sources, dates and production requirements, then documents the collection or delivery with a reconciled manifest.
Expert testimony starts with counsel on the disputed proposition and the disclosure rules and ends with a report or opinion from the qualified expert who will defend it.
A typical workpaper ties a claimed transfer to the email attachment, the account event and the file artifact behind it, with clock differences and alternative explanations recorded so nothing surprises you at deposition. Ask for a sample, and for the proposed examiner's qualifications, during your free consultation.
When the Matter Is Also a Breach
An incident often needs both preserved evidence and an assessment of how the intruder got in. Our cybersecurity team works alongside the examiners, so response and examination are coordinated before remediation changes the records you need.
Explore Enterprise CybersecurityWhat to Have Ready for the First Call
Have the issue, the people, the sources, the preservation risks and the deadline in mind. We set up a secure channel before any evidence or confidential documents change hands, so the first conversation can stay at that level.
For matters that span locations, our regional engagement information shows the sixteen US offices and the international line we work from.
For an active matter, call the hotline now. It is answered 24/7, and the first consultation with an examiner is free.
Prepare for the first call
Preparation Packs for Three Common Matters
Each pack helps the legal team and client IT find the devices, accounts, archives and logs that matter in one kind of dispute, name the people who control them and write down the questions the examiner will need answered. A matter that arrives with that work done moves faster from the first call to preservation.
Every guide is free to read online. A download asks for a work email and company, which you may skip, and the file starts immediately.
Get a free consultation
Records to preserve when an employee leaves
Identify the departing employee's devices, email, cloud storage, archives, backups and logs so client IT can lock them down before reassignment overwrites the evidence.
File: ZIP: source guide, checklists and sample questions.
Records behind a commercial or contract dispute
Locate the contracts, messages, collaboration records and business system data that show what was agreed and what was done, then organize the questions the attorneys and system owners must resolve.
File: ZIP: source guide, checklists and sample questions.
Records in a medical matter
Identify the records held in EMRs, practice systems, patient portals and audit logs, then document the custodians, retention periods and access questions before anything is requested.
File: ZIP: source guide, checklists and sample questions.
Talk with an examiner
Get a Free Consultation on Your Forensic Matter
Tell us the systems, the evidence and the deadline. A senior examiner will call or write back promptly to check conflicts, talk through scope and tell you what an examination would deliver, and the first conversation is free.
Global Digital Forensics has served AmLaw 100 firms and Fortune 1000 companies since 1992, with court tested experts, sixteen US offices and a hotline answered 24/7.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .