New York Computer Forensics, eDiscovery and Expert Testimony

New York Digital Forensics Experts That Win Cases

A New York dispute is usually decided by what a mailbox, a phone or a cloud tenant still holds on the day someone finally looks. Global Digital Forensics preserves that record, examines it and puts the examiner who did the work in front of the court; in COMLAB v. Kal Tire the Southern District found our examiner's testimony highly credible. The Manhattan office scopes every matter against the forum, the deadline and the records most likely to disappear first.

Illustrative Manhattan skyline and waterfront in New York City.

Call the Manhattan Office Before the Logs Roll Over

New York matters start at the Manhattan office, (212) 561-5860, and after hours on the 24/7 hotline, (800) 868-8189. The first call settles which communications and company records will actually show what happened, and where the people and the equipment that hold them are today. The law firm, the employer and the custodian are rarely in the same building, so the collection follows them, not the nearest courthouse.

A mailbox can be preserved remotely while the account stays in use. Computers and phones are collected on a handling plan agreed with whoever holds them, custody is documented from the moment a device changes hands, and the reporting deadline stays in front of the retaining team from day one. The consultation is free, and it is the right moment to decide what gets preserved first.

Get a Free Consultation

One Evidence Plan When a Matter Spans Several Offices

A departure from a Park Avenue headquarters rarely stays in Manhattan. The laptop is in Westchester, the phone is in New Jersey and the tenant is administered from another state. Give us the devices and accounts in each location, the administrator who controls each one and what the retaining team has to report, and we run one evidence plan for the whole matter instead of a separate collection in every city.

The borough, county and court pages below carry the venue detail for New York discovery and testimony. For a locally managed collection in the city, on Long Island or in Westchester, our New York Computer Forensics site covers regional engagements in depth, and the national service pages set out the full methods and deliverables.

Departing Employees and the Files They Took

When an employee leaves with the customer list or the design files, the proof sits in the mailbox, the cloud sync client, the USB history and the phone, and every week of normal use erodes it. Flat rate employee exit Core Analysis covers an agreed scope review at a fixed price; a full trade secret forensic examination fits the matter that is headed for court.

For an executive departure or a partner separation, bring the business records, the account authority and the decisions the examination has to support to the first call.

New York Computer Forensics: local departure and collection planning.

Several Offices, One Timeline

We collect the authorized email, cloud and device sources in every location involved and build a single activity timeline in which each entry points back to the artifact it came from. Scope and deliverables are set with the New York retaining team, so the report answers the questions actually being asked.

Plan a Multi Office Collection

The engagement

Records That Expire in Weeks, Examined by Testifying Experts

New York matters move fast and the deciding records are almost always digital: handsets and their cloud backups, Microsoft 365 and Google Workspace mailboxes, Slack and Teams, endpoint telemetry, SaaS and cloud audit logs, badge and camera systems and, in financial disputes, brokerage and trading platform logs. Many of those sources keep their history for weeks. Preserving them early is what keeps the useful record from being overwritten before anyone has assessed the matter.

The Manhattan office takes New York matters and dispatches examiners into the five boroughs, Westchester and Long Island around the clock for active incidents. Litigation work is scoped up front against the forum, whether the Southern or Eastern District, a New York State Supreme Court or a regulator such as NYDFS or the New York Attorney General, so the deliverables fit the venue and its schedule.

The examiner who does the work writes the report and gives the testimony. Joseph Caruso, our founder and a CISSP, was accepted by the Southern District as an expert in computer forensics and computer science in COMLAB v. Kal Tire. Robert Knudsen, a CISSP and Certified Computer Examiner, spent twenty years with the New York City Police Department before eighteen years of forensic casework in federal and state courts. Every engagement runs on documented chain of custody, validated tools, reproducible notes and a clear line between what the record shows and what the expert concludes from it.

When the source that matters keeps its logs for weeks, not years, call (800) 868-8189 and we will say which record to preserve tonight.

Local venues and regulators

The Courts and Regulators New York Evidence Must Satisfy

  • Southern District of New York (SDNY)

    Preservation, collection, processing and expert report support for matters in the Daniel Patrick Moynihan Courthouse at 500 Pearl Street and the Thurgood Marshall Courthouse at 40 Foley Square. Workpapers are prepared for opposing expert review, motion practice and Daubert challenges, and eDiscovery workflows are built to the Rule 26(f) discussion and the Rule 34 production form obligations with load files matching what the receiving side actually uses. It was in this district that the court accepted Joseph Caruso as an expert and found his testimony highly credible.

  • Eastern District of New York (EDNY)

    Matters filed in Brooklyn and Central Islip commonly call for mobile device preservation from parties and nonparty custodians in Brooklyn, Queens, Nassau and Suffolk, cloud collections from Microsoft 365, Google Workspace and Slack and reports written for the schedule the assigned judge sets. Our EDNY eDiscovery page explains how the plan is built from the order.

  • New York State Supreme Court

    Reports and technical records for matters in the New York, Kings, Queens, Bronx, Richmond, Nassau, Suffolk and Westchester supreme courts. State court matters often involve business records subpoenaed under CPLR 3120, discovery orders for electronically stored information and, in the Commercial Division, electronic discovery requirements under the applicable state rules and the case order.

  • NYDFS 23 NYCRR Part 500

    Part 500 covers risk assessment, vulnerability management, access controls, audit trails and incident response, and section 500.17 requires notice of a qualifying cybersecurity incident within 72 hours after the covered entity determines it occurred. We build the incident chronology and the testing record a covered entity needs to meet that clock and answer its examiner.

  • New York SHIELD Act

    General Business Law section 899-bb requires reasonable safeguards for New York residents' private information, and General Business Law section 899-aa requires notice to affected residents within thirty days after a breach is discovered. Our incident timeline, affected data determination and remediation record are built to feed the notification decision inside that window.

  • Southern and Eastern District U.S. Attorney's Office matters

    For subjects of federal criminal or civil enforcement in the Southern and Eastern Districts, independent forensic work supports the technical side of representation before charges, parallel civil proceedings and internal reviews. The record is kept on a defensible chain of custody so counsel controls production and privilege decisions.

Coverage detail

Boroughs and Counties

The Manhattan office handles the city and Westchester, and the Oceanside office in Nassau County, (516) 806-6091, handles Long Island. Each page below covers the venues, the industries and the custodians that shape matters in that part of the metro.

New York focus pages

NYDFS Testing, Federal Discovery and Live Incidents

Start here when a regulator, a federal district or an incident still in progress defines the matter.

Bring the devices, accounts and dates involved to a free first call. Start the conversation here.

Build the Source Inventory Before Anything Moves

An employer laptop, a tenant account and a bank or vendor record each have a different owner and a different collection path, so we pin down the disputed event, the access authority and the retention before choosing a method. The device plan records custody, condition, encryption, the acquisition method and the receiving examiner. The cloud plan records the administrator, the license, the hold settings, the export route and any audit range that has already aged out.

The first inventory marks every source as preserved, waiting on authority or gone, and ties each one to the question it answers, so the retaining team sees at a glance what the record will be able to prove. The retaining firm supplies the state or federal order and the production requirements, and the Manhattan office arranges visits and device transport before anything moves.

Have the device and tenant list ready, then walk through the first inventory with the Manhattan office on a free first call.

Frequently asked

Starting a New York Matter

Do you have a New York office?

Yes. The New York office in Manhattan at (212) 561-5860 is the intake for New York matters, and examiners are dispatched into the five boroughs, Westchester and Long Island around the clock for active incidents. Working meetings are held at the law firm's offices, at the client site or by video, and the 24/7 hotline at (800) 868-8189 reaches the whole practice.

Which courts and tribunals can your work support?

Our examiners are court tested and have supported matters in federal and state courts, and the expert practice spans federal district court, multidistrict litigation, arbitration and ITC Section 337 proceedings. In COMLAB v. Kal Tire the Southern District of New York accepted our founder as an expert in computer forensics and computer science. Deliverables are prepared for the forum in question, whether that is the Southern or Eastern District, a New York State Supreme Court, an arbitration panel or a regulator.

How fast can you get on site for a breach in the five boroughs?

Call the 24/7 hotline and tell us the affected tenant or system, who can authorize containment and which administrator controls the records with the shortest retention. Remote preservation starts as soon as that authority is confirmed, often within the first call, and an examiner is dispatched on site in the five boroughs when the systems require hands on collection. Password resets, session revocations and collection steps go into one action log from the start.

Do you handle NYDFS 23 NYCRR Part 500 penetration testing?

Yes. The engagement is scoped to the covered entity's information systems as defined in section 500.1, and the testing program is documented against section 500.5: at least annual penetration testing from inside and outside the information systems, plus automated scans and manual review of systems not covered by those scans at a frequency determined by the risk assessment and promptly after material system changes. Deliverables are organized so the CISO can hand the report to internal audit, to the board committee that receives the section 500.4 report and, where relevant, to the DFS examiner.

Can you take a matter that already has another expert on it?

Yes. Rebuttal, neutral and second opinion engagements are a regular part of the practice. We start with a documented review of the opposing expert's method, tools and workpapers against accepted practice, test what can be reproduced from the underlying data and tell counsel early which findings help the case and which hurt it.

Do you work with individuals as well as companies?

Both. Corporate matters such as internal reviews, employment disputes, trade secret protection, incident response, regulatory work and transaction diligence make up most of the practice. Our examiners also work for attorneys representing individuals where the technical questions and the evidence sources are the same, including estate, contract and intellectual property disputes over data, devices and accounts.

Talk with an examiner

Tell the Manhattan Office What Happened

Tell us where the people and the devices are and what the matter has to prove. A senior examiner calls back, hears the facts in confidence and tells you what can be preserved now and what the examination would involve. The consultation is free.

Since 1992 · 24/7 dispatch · Court tested experts

Or call (800) 868-8189

Email or phone is required. For an active incident, please call. Read what we send with the request.

Your first call

Bring the New York Matter to a Testifying Examiner

On the first call a senior examiner hears the facts, names the records to preserve this week, explains how the devices or access will be handed over and gives you a scope and timeline for the examination. We arrange a secure transfer for evidence and credentials.

Manhattan office: (212) 561-5860

Local service intersections

New York service pages

  • Bronx Digital Forensics

    Digital forensics, eDiscovery and incident response for Bronx corporations and healthcare institutions. Bronx Supreme Court.

  • Brooklyn Digital Forensics

    Digital forensics, eDiscovery and incident response for Brooklyn corporations and tech companies. Kings County and EDNY coverage.

  • eDiscovery in the Eastern District of New York

    Preservation, collection, processing and production for matters in EDNY. Brooklyn and Central Islip coverage on tight schedules.

  • Computer Forensics Expert Witness in New York

    Party retained computer forensics expert reports and testimony for New York State Supreme Court matters and for the Southern, Eastern, Northern and Western Districts under FRE 702.

  • 24/7 Incident Response, New York

    24/7 incident response across the five boroughs, Westchester and Long Island. Cloud, endpoint and identity coverage with on site dispatch from the New York office.

  • Long Island Digital Forensics

    Digital forensics, eDiscovery and incident response across Nassau and Suffolk counties. EDNY Central Islip coverage.

  • Manhattan Digital Forensics

    Digital forensics, eDiscovery and 24/7 incident response for Manhattan corporations, law firms and financial institutions.

  • Nassau County Digital Forensics

    Digital forensics, eDiscovery and incident response for Nassau County corporations and law firms. Mineola and Garden City.

  • NYDFS 23 NYCRR Part 500 Penetration Testing

    Human led penetration testing scoped to NYDFS 23 NYCRR Part 500 for banks, insurers, MSBs and other covered entities in New York.

  • Queens Digital Forensics

    Digital forensics, eDiscovery and incident response for Queens corporations and logistics operators. Queens Supreme and EDNY.

  • eDiscovery in the Southern District of New York

    Preservation, collection, processing and production for matters in SDNY. Workflows designed to FRCP practice and the schedule.

  • Suffolk County Digital Forensics

    Digital forensics, eDiscovery and incident response for Suffolk County. Riverhead, Melville, Hauppauge and Stony Brook coverage.

  • Westchester Digital Forensics

    Digital forensics, eDiscovery and incident response across Westchester County. White Plains, Yonkers and Rye coverage.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .

Privacy center

Choose your site settings

Optional technology stays off until you choose otherwise. You can change these browser settings at any time. Access to the core site does not depend on optional technologies.

Technology preferences
Sale or cross-context sharing: not used GDF does not sell or share website personal information for cross-context behavioral advertising.