Forensics, eDiscovery and Expert Testimony for Law Firms
Digital Forensics for Law Firms, From Preservation to Testimony
Litigation now turns on records nobody wrote to be evidence: a laptop's file history, a phone's messages, a mailbox audit log, a cloud tenant's sharing events. Global Digital Forensics preserves that record before it rolls over, examines it to answer the disputed fact, and puts an examiner who has testified in federal and state courts behind the findings. AmLaw 100 firms and small and midsize practices bring us the same questions, and the first call with a senior examiner is free.
Discuss your case
Name the Disputed Fact, and We Map the Proof
Every engagement begins with a conversation between an attorney and a senior examiner, not with a tool. Bring the pleading or the allegation, the people and devices involved and the next date on the calendar, and we will tell you which sources can answer the question, what must be preserved this week and what the examination will deliver.
Discuss your evidence and deadline
Preserve and collect
We identify custodians, devices, accounts and retention windows, then image or export each source under a documented chain of custody before reassignment or a retention policy overwrites it.
Examine and explain
We reconstruct what happened on the device and in the account, tie each finding to the artifact behind it and separate what was observed from what is inferred.
Expert support
We match the disputed technology with an examiner whose experience fits it and handle the report, review of the opposing expert, deposition and trial testimony.
For counsel and litigants
Forensic, eDiscovery and Expert Services Grouped by Matter
Choose the group that matches your matter. Each link opens a service page that explains the evidence involved, how we examine it and what the retaining firm receives.
Litigation
Court facing digital forensics, expert testimony and workpapers written to be challenged.
eDiscovery
Preservation, collection, processing, review and production on software GDF owns, from a single custodian to a national matter.
- eDiscovery Collections & Processing
- eDiscovery Services for Law Firms
- Corporate eDiscovery Services
- eDiscovery Cloud Collections
- Mobile & Endpoint eDiscovery Collections
- eDiscovery Legal Hold Support
- eDiscovery Managed Review
- eDiscovery Production Services
- eDiscovery Early Case Intelligence
- eDiscovery Data Discovery & Source Mapping
- eDiscovery Review Platform
- eDiscovery Security & Compliance
- Structured Data eDiscovery
Examinations & internal matters
Employee departures, trade secret and internal fraud examinations.
Emerging evidence
Cryptocurrency, deepfake, IoT, wearable, vehicle and AI evidence.
- Cryptocurrency Forensics for Federal, Enforcement and Civil Matters
- Deepfake Detection and Authentication for National Matters
- IoT and Smart Home Forensics for National Matters
- Wearable Device Forensics for National Civil and Criminal Matters
- Vehicle Forensics for National Civil and Criminal Matters
- Drone and UAV Forensics for National Civil and Criminal Matters
- AI Forensics
Why law firms call us
Where Cases Go Wrong, and Why Law Firms Call Us
Most disputes now turn on records that were never written to be evidence: chat threads, collaboration histories, mobile backups, cloud audit logs and telemetry from systems that overwrite themselves on a schedule. The window for preserving those artifacts is usually shorter than the window in which a matter is assessed, and a device reassigned or a retention policy left running can decide a case before anyone has looked at the evidence.
Global Digital Forensics has examined digital evidence for law firms, corporate counsel and insurers since 1992. Our examiners have testified in federal and state courts, our work has been accepted by courts, and our national technology practice most often serves AmLaw 100 firms and Fortune 1000 companies as well as small and midsize businesses. Founder Joseph Caruso, CISSP, began his technology career in 1980 and supports trial teams in disputes over source code, databases and complex business systems. Veronica Perez is an EnCase and Cellebrite certified examiner who has been designated a digital forensics expert in California, Oklahoma and South Carolina state courts and in federal court in Chicago. Robert Knudsen, CISSP and Certified Computer Examiner, brings eighteen years of forensic casework and hundreds of examinations in federal and state court matters.
Synthetic media adds a second authenticity question. Audio, video, images and documents can now be generated or altered convincingly enough that authenticity must be tested rather than assumed, and the testing has to be documented in a form a court can weigh. The same discipline applies to a collection done before we arrived: we assess its authority, method, source coverage and validation record, because undocumented source changes and missing metadata create questions the receiving examiner has to resolve.
Ask who would testify in your matter; the examiners and their court history are set out here, and the first call covers fit and conflicts.
Scoping
Evidence Location, Repeatability and Fact Versus Opinion
- What evidence exists, where does it live, and how quickly is it being overwritten?
- Can the collection be repeated by the other side’s expert and reach the same result?
- Which findings are observed fact, and which are expert interpretation?
- What does the evidence not show, and what would it take to resolve that gap?
- What form must the exhibits and the report take for this court, this filing and this deadline?
How we help
Forensic Examination, Authentication and Response From One Team
-
Digital Forensics and Expert Witness Testimony
Preservation, forensic imaging, analysis, reports and testimony written to survive cross examination, from the examiner who did the work.
-
AI & Deepfake Analysis
Authentication of disputed audio, video, images and AI generated documents, before they enter the record or after the other side offers them.
-
Biometrics & Identity Sciences
Fingerprint, facial and identity system evidence examined and, where the record supports it, rebutted by qualified scientists.
-
Incident Response SLA
Response times committed in an SLA and a hotline answered 24/7 for a client’s incident, so evidence is preserved before remediation changes it.
Context
The Evidentiary Standards We Write To
- Federal Rule of Evidence 702 and Daubert
- Expert opinion is admitted on the reliability of the method and the qualifications of the examiner, so we document method, tooling and limitations in a form that can be examined line by line. The court rules on admissibility; our job is to make sure the work deserves it.
- Authentication
- A digital record has to be shown to be what it is claimed to be, which is a question of acquisition, hashing and chain of custody long before it is a question of content.
- Spoliation and legal hold
- We identify the sources inside the hold counsel sets, document exactly what was preserved and when, and flag any gap while there is still time to close it.
- Privilege and work product
- Engagements can be structured through outside counsel where the analysis is intended to sit inside privilege, and we follow counsel’s direction on what is reviewed and by whom.
Every report is written to the evidentiary standard the forum applies, and the examiner can explain the method in those terms on the stand.
If the opposing expert’s method is the question, describe the report to a senior examiner and we will say what a line by line review would take.
Related case study
Intellectual Property Case
GDF examiners joined a court authorized seizure team with United States Marshals, imaged and searched about thirty computers across five locations and linked communications, inventory and transactions across the sources for the legal team.
Intellectual Property
Litigation support
What the Technical Record Can Answer for Your Case
The distinctions and deliverables that matter when digital records enter a dispute.
Forensics is not data recovery, and it is not eDiscovery
Data recovery restores data after a failure. eDiscovery produces what was requested from identified custodians. A forensic examination goes further, into slack and unallocated space, hidden and system files, the artifacts an operating system leaves behind and the date codes that show when material was created, modified, accessed or deleted. That is where the evidence nobody produced tends to sit.
What comes back to you
Depending on the matter, you receive acquisition and chain of custody records, a sourced timeline, recovered files and exhibits and a concise written report that uses accepted methodology, stays scoped to the questions in dispute and states plainly which sources were missing or unresolved. In COMLAB v. Kal Tire, Joseph Caruso showed from document metadata that the opposing party’s emails had been fabricated, and the Southern District of New York called his testimony reasonable, logical, and ultimately highly credible.
Laboratory support for other experts
Examiners working a matter can retain examination capability without building a laboratory: email, images, phone logs, transactions, browsing history and social artifacts, including material deleted or hidden, recovered and documented so it survives the same scrutiny as the rest of the file.
Ask for a walkthrough of a report structure on the free first call to see the deliverables.
From the First Call to the Expert Report
Bring the pleadings or the disputed proposition, any relevant order, the custodian and source list, the deadline and what is known about prior handling. Collection volume, encrypted or unavailable sources, third party access, the level of report detail and whether testimony is expected all shape the scope, and a senior examiner will walk through each of them with you at no charge for the first conversation.
Preservation comes first. We produce a preservation inventory that names each custodian, system owner and retention setting, the action taken and any source not yet preserved, so the gaps are visible while there is still time to close them. The examination log that follows records the acquisition method, tool versions, hash checks, any change to a source and every technical exception.
The findings arrive with their basis attached. An opinion workpaper ties a conclusion about a file transfer to the artifact and timestamp behind it and then lists the alternatives, such as a sync process, a shared account or a missing log, that were considered and ruled in or out. Hash values establish that files match; separate evidence supports conclusions about authorship and intent.
Counsel keeps control of responsiveness, privilege and disclosure throughout. The expert's report lays out the technical basis for every opinion, and the examiner who wrote it is the examiner who defends it in deposition and at trial.
Current federal practice and evidence rules · Examiner background and qualification planning
Gather records before an engagement
Gather the Records First and the Call Goes Further
Each guide helps attorneys and client IT identify the devices, accounts, archives and logs that matter in a kind of matter we see often, name the people who control them and write down the questions the examiner will need answered.
Every guide is free to read online. A download asks for a work email and company, which you may skip, and the file starts immediately.
Discuss your evidence and deadline
Departed employee data sources
Identify the departing employee’s devices, mail, cloud storage, archives, backups and logs so client IT can lock them down before reassignment.
File: ZIP: source guide, checklists and sample questions.
Key Data Sources in Commercial and Contract Litigation
Locate the contracts, messages, collaboration records and business system data that show what was agreed and what was done, with questions for the legal team and system owners.
File: ZIP: source guide, checklists and sample questions.
Medical matter data sources
Identify the records held in EMRs, practice systems, patient portals and audit logs, then document the custodians, retention periods and access questions.
File: ZIP: source guide, checklists and sample questions.
Browse all preparation packages by subject.
Have the custodian list but not the retention settings? Send what you have to a senior examiner and we will say what must be locked down this week.
Talk with an examiner
Bring the Disputed Record to a Senior Examiner
Tell us the matter, the sources and the deadline. A senior examiner will call or write back promptly to check conflicts, confirm the right expert and outline the preservation plan, and the first conversation is free.
Global Digital Forensics has served law firms and their clients since 1992, with court tested examiners, sixteen US offices and a hotline answered 24/7.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .