Prepare for a forensic consultation
What to prepare, what affects scope and which findings or reports to expect.
Authoritative Technical Guides for Attorneys, CISOs, and Risk Leaders
Executive Guides on Digital Forensics, eDiscovery, and Cybersecurity
A lawyer preparing for a deposition, a board weighing a breach disclosure and a deal team pricing cyber risk all need the same thing, a clear account of what the technical record shows. These guides and publications come from the examiners who do the work, and if the question is urgent, call (800) 868-8189 instead of reading.
Start With the Decision in Front of You
Most readers arrive here with a specific problem: a departing employee, a compromised mailbox, a device that must be preserved tonight or an assessment that has to produce a usable deliverable. These five guides are the fastest route to the preparation that matters, and each one ends where a conversation with a GDF examiner begins.
Prepare for an email compromise examination
Which identity, email and cloud records may help explain the event.
Prepare a useful forensic handoff
Preservation decisions to discuss before ordinary activity changes the records.
Choose an assessment deliverable
The scope, finding and corrective action records to agree with an assessment.
Understand the examination process
How a matter moves from a question through preservation to a report or testimony.
If none of the five fits the problem on your desk, describe it to a senior examiner and we will point you to the right guide or straight to a scope.
Browse by topic
Six Topic Pages That Put the Guides in Reading Order
Each topic page explains the decision a reader faces, orders the guides in the sequence an examiner would read them, and links the services, tools and checklists that go with them.
Cloud and Email Evidence After a Wire Fraud
A diverted wire or a hijacked mailbox leaves its record in cloud logs that expire on the provider's schedule, not yours.
Digital Evidence That Holds Up in Court
Trial counsel need digital evidence that a court will credit and an expert whose method survives a Rule 702 challenge.
Breach Response the Board and Regulators Can Defend
A breach puts the CISO, breach counsel and the board on the same clock with different questions.
OT Security Testing That Never Trips the Plant
Industrial and utility operators need security evidence that was gathered without endangering the process.
Who Took the Data, and What Can You Prove?
When a key employee leaves for a competitor or proprietary code turns up elsewhere, the company has days to preserve the record that decides the case.
Compliance Testing Your Auditor Will Accept
Hospitals, defense contractors, merchants, law firms and midsize companies answer to different rules that ask the same question: was the testing real and can you show it.
Executive showcase
Current Guides, Filtered by the Topic You Are Working On
Choose a topic to narrow the showcase to the guides that bear on your matter. It holds 50 current guides: 18 flagship 2026 publications and 32 legacy posts rebuilt as evergreen guides in October 2026. The 62 older posts from 2012 to 2016 are kept at their original addresses in the publication archive.
Preserving Microsoft 365 and Google Workspace Evidence After Token Theft
The First 24 Hours of a Business Email Compromise
Reconciling Teams, Slack and Email Collections Before Review
Mapping Cloud Evidence Across Tenants Before Collection Begins
Stopping Spoliation When an Employee Departs
Building a Forensic Record for Cross Examination
Preparing the Expert File for Rule 702, Daubert and Frye
One Location Timeline From GPS, Cell Tower and App Data
Authenticating Questioned Photos, Audio and Video in the Deepfake Era
Scoping Digital Forensics to Control Cost and Time
Preserving Volatile Evidence in the First Hours of Incident Response Without Slowing Down Recovery
Scoping New York SHIELD Act Notification From the Data Record
Validating Shared NYDFS Part 500 Controls Across Affiliates
Pre Close Cyber Due Diligence for Breach Liabilities
Reproducible AI Red Teaming for Prompt Injection and Leakage
Scoping SCADA and OT Security Testing Around Physical Safety and Zero Operational Downtime
Validating IT and OT Segmentation Across Industrial and Utility Sites
Passive First OT Asset Discovery Across Plants
Scheduling Mandated Penetration Tests Ahead of Audit Deadlines
When Extortion, Blackmail or a Deepfake Targets Your Executives
Mobile Workforce Controls and Forensic Readiness for iOS and Android
DFARS 252.204-7012 and CMMC Readiness for Defense Contractors
Security Architecture and Digital Forensics Working Together
Risk Assessments and 24/7 Incident Response From One Team
Ransomware Response That Protects Clinical Operations and Evidence
Cyber Risk Governance Across Testing, Retainers and Breach Analysis
Proving Control Maturity to Cyber Insurers
Technical Evidence for SEC Materiality and Form 8-K Disclosure
Protecting Board Members and Senior Officers From Targeted Attacks
Why CISOs and Audit Committees Need Independent Cybersecurity Validation
Forensic Attribution in Vendor and Real Estate Wire Fraud
How Attackers Target Bank and Fintech Employees
Detecting Long Dwell Intrusions Inside Financial Networks
Auditing Trusted Vendor Connections After a Supply Chain Compromise
Hardening Verification Against Executive Impersonation and Voice Cloning
Building a Litigation Timeline From Cross Platform Artifacts
Recovering Deleted Texts, Encrypted Chats and SQLite Artifacts From Phones
Phone and Infotainment Forensics for Catastrophic Accident Litigation
IoT, Smart Building and Wearable Forensics for Alibi Evidence
Cloud eDiscovery Architecture That Controls Review Costs
Proving Unauthorized Access in Corporate Espionage and Trade Secret Litigation
A 48 Hour Preservation Protocol for Departing Executives and Engineers
Detecting the Exfiltration of Source Code and Research Assets
Reconstructing Deleted Executive Email, Off Channel Messages and Wiped Servers
How Infostealers on Home Office Devices Compromise Corporate Cloud Tenants
HIPAA Breach Forensics for Health Records and Medical Devices
PCI DSS 4.0.1 Penetration Testing and Segmentation Validation
Manual Application, API and Source Code Testing for Logic Flaws
Protecting Law Firm Files, Deal Rooms and Trust Accounts
Priority Incident Response Retainers for Mid Market Companies
Insights
Two Ways to Read, Through Publications or Case Studies
Publications explain the technical and decision issues before you face them. Case studies show how evidence was used in real matters, drawn from public court records and anonymized engagements.
- 01 / Publications
Analysis and technical guidance
Current guidance for evidence, security and risk decisions, grounded in public standards.
Browse publications - 02 / Case Studies
Evidence in practice
Public record and anonymized case accounts across litigation, fraud, discovery and regulatory matters.
Browse case studies
Read the publication that matches your matter, then follow the process guide to see how an engagement would run from the first call to the report.
Current publications
Guidance for Evidence and Risk Decisions
Original analysis grounded in public standards, with the practical limits of each method stated alongside it, written by examiners who expect to be cross examined on the same questions.
-
Evidence practice
Building a Forensic Record for Cross Examination
How trial attorneys and certified forensic examiners collect, authenticate and present digital evidence that survives Daubert and cross examination.
-
Incident response
Preserving Volatile Evidence in the First Hours of Incident Response Without Slowing Down Recovery
How CISOs and breach counsel contain ransomware and network intrusions while preserving volatile RAM, firewall logs and legal privilege in the first hours.
-
Operational technology
Scoping SCADA and OT Security Testing Around Physical Safety and Zero Operational Downtime
Scope industrial control system, utility and maritime OT security assessments around physical safety, PLC stability and zero operational downtime.
-
Transactions
Pre Close Cyber Due Diligence for Breach Liabilities
Protect private equity acquisitions and corporate mergers with pre close cyber due diligence, compromise assessments and source code audits.
-
Media authentication
Authenticating Questioned Photos, Audio and Video in the Deepfake Era
Authenticate disputed photographs, audio and video for court using container forensics, pixel analysis and sensor provenance rather than AI scores.
-
AI security
Reproducible AI Red Teaming for Prompt Injection and Leakage
Secure enterprise AI deployments, RAG pipelines and custom LLMs against prompt injection, unauthorized tool execution and training data leakage.
When a publication raises the exact question your matter turns on, bring it to the examiner who wrote it; the hotline answers around the clock.
Technical field notes
Checks and Decision Points From Active Casework
Short practical records for evidence collection, incident response and operational security, each built around the questions legal and technical owners ask when the clock is running.
-
Enterprise incident response
The First 24 Hours of a Business Email Compromise
Coordinate finance, legal and IT security in the first 24 hours of a business email compromise or wire fraud event to preserve cloud evidence.
-
Evidence preservation
Stopping Spoliation When an Employee Departs
Preserve digital evidence correctly during employee offboarding, laptop returns and cloud license revocations.
-
Planning the engagement
Scoping Digital Forensics to Control Cost and Time
How general counsel, trial attorneys and internal auditors scope digital forensics engagements across laptops, mobile phones and cloud tenants efficiently.
-
Expert methodology
Preparing the Expert File for Rule 702, Daubert and Frye
Build a digital forensics expert file ready for Rule 702, Daubert and Frye challenges in high stakes litigation.
-
Mobile evidence analysis
One Location Timeline From GPS, Cell Tower and App Data
How forensic examiners validate iPhone and Android location timelines by reconciling GPS accuracy radii, cached WiFi beacons and cloud sync logs.
-
Enterprise breach evidence
Scoping New York SHIELD Act Notification From the Data Record
Limit breach notification exposure under the New York SHIELD Act by using forensic artifact correlation to prove exact unauthorized access scopes.
-
Financial services control evidence
Validating Shared NYDFS Part 500 Controls Across Affiliates
Satisfy NYDFS 23 NYCRR Part 500 requirements with manual penetration testing, shared affiliate control validation and defensible audit evidence.
-
Operational technology boundaries
Validating IT and OT Segmentation Across Industrial and Utility Sites
Validate firewall boundaries, data historians and vendor remote access tunnels across multi site industrial and utility OT networks.
-
OT asset coverage
Passive First OT Asset Discovery Across Plants
Build a complete, comparable inventory of PLCs, RTUs, HMIs and industrial firmware across plants using safe passive network discovery.
-
Collaboration evidence
Reconciling Teams, Slack and Email Collections Before Review
Prevent costly discovery gaps across Microsoft Teams, Slack and corporate email by reconciling modern attachments, channel edits and cloud export limits.
-
Cloud collection planning
Mapping Cloud Evidence Across Tenants Before Collection Begins
Build a defensible cloud evidence source map across Microsoft 365, Google Workspace, AWS and acquired business tenants for litigation and incidents.
Working a matter against the clock right now? Call (800) 868-8189 rather than reading further.
Archive
Explore the Archive
The publication archive keeps every post from 2012 to 2019 at its original address and date, including the 32 rebuilt as current guides in October 2026. These are the most recent of the 62 historical articles, which record what the firm was telling clients about threats and evidence as each year unfolded.
-
Archive
Hacked for the Holidays Global Digital Forensics can Help
December 21, 2015
-
Archive
Come Out of the Summer With a Clean Cybersecurity Slate
August 31, 2015
-
Archive
Mobile Apps Are a Major Gateway for Hackers
July 27, 2015
-
Archive
Effective Response Plan Key to Surviving a Data Breach
July 20, 2015
-
Archive
Out of Sight, Out of Mind: Hackers Bank On It
July 13, 2015
-
Archive
Cyber Security Tips for a Safer and Happier Summer Vacation
June 5, 2015
Talk with an examiner
Bring the Question to an Examiner Who Has Testified
Reading prepares you. A conversation with a senior examiner tells you what the evidence in your matter can support and what it will take to find out. The initial consultation is free, and the hotline answers around the clock.
24/7 hotline: (800) 868-8189
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .