New York coverage
Digital Forensics in New York
Forensic examination, expert witness testimony and cybersecurity testing for matters in New York state and federal courts. Manhattan office with 24/7 response across the five boroughs, Westchester and Long Island.
The engagement
How GDF works in New York
New York matters move fast and the source records are almost always digital: mobile handsets and their cloud backups, Microsoft 365 and Google Workspace mailboxes, Slack and Teams workspaces, endpoint EDR telemetry, SaaS audit logs, cloud control-plane events, badge and camera systems, and, in financial matters, brokerage and trading platform logs. Most of that evidence rotates on a schedule shorter than the window in which the dispute is assessed. Preservation on day one is usually the difference between a full record and a partial one.
The Manhattan office is the primary intake for New York matters. Examiners are dispatched into the five boroughs, Westchester and Long Island on a 24/7 basis for active incidents. For litigation, work is scoped up front against the forum (SDNY, EDNY, New York State Supreme Court, or a regulator such as NYDFS or the New York Attorney General) so the deliverables match the venue and the schedule.
The engagement model is independent and technical. GDF produces the forensic record, the expert report and, where the matter reaches it, deposition or trial testimony. Admissibility is decided by the court. What GDF is retained to do is make the underlying method defensible: documented chain of custody, validated tooling, reproducible notes and a clean separation between observed facts and expert opinion.
Local venues and regulators
Where New York matters actually land
Southern District of New York (SDNY)
Preservation, collection, processing and expert-report support for matters in the Daniel Patrick Moynihan Courthouse and 500 Pearl Street. Workpapers are prepared for opposing-expert review, motion practice and Daubert challenges. eDiscovery workflows are designed to meet FRCP Rule 26(f) discussion requirements and Rule 34 production form obligations, with load files (Concordance DAT, Relativity RDX, EDRM XML) matching what the receiving side actually uses.
Eastern District of New York (EDNY)
Coverage of matters filed in Brooklyn and Central Islip. Common technical work: mobile device preservation from parties and non-party custodians in Brooklyn, Queens, Nassau and Suffolk; cloud collections from Microsoft 365, Google Workspace and Slack; and reports written for the schedule the court sets, which in EDNY tends to be tight.
New York State Supreme Court
Reports and testimony in the New York, Kings, Queens, Bronx, Richmond, Nassau, Suffolk and Westchester supreme courts. State-court matters often involve business records subpoenaed under CPLR 3120, discovery orders for ESI (electronically stored information) and, in the Commercial Division, eDiscovery expectations that track FRCP practice.
NYDFS 23 NYCRR Part 500
Covered entities under the New York Department of Financial Services cybersecurity regulation carry specific technical obligations: risk assessments (500.9), penetration testing and vulnerability assessments (500.5), multi-factor authentication (500.12), audit trail (500.6), incident response (500.16) and 72-hour cybersecurity event notice (500.17). GDF supplies the underlying technical record used to demonstrate those controls.
New York SHIELD Act
New York General Business Law 899-bb requires reasonable administrative, technical and physical safeguards for private information of New York residents. When a breach occurs, section 899-aa notification obligations follow. Incident response work is scoped so the technical timeline, affected-data determination and remediation record are usable inputs to counsel's notification analysis.
Southern and Eastern District U.S. Attorney's Office matters
For subjects of federal criminal or civil enforcement in SDNY and EDNY, independent forensic work supports the technical side of pre-indictment representation, parallel civil proceedings and internal reviews. The record is kept on a defensible chain of custody so it can be produced or withheld as counsel directs.
Coverage detail
Boroughs and counties
Every New York matter is dispatched from the same Manhattan intake. The borough and county pages describe the specific venues, custodian profiles and response patterns for each part of the metro.
New York focus pages
Local practice detail
The focus pages below cover regulator, venue and incident work that lands most often on New York matters.
Frequently asked
Common questions on New York matters
Do you have a New York office?
Yes. The Manhattan office at (212) 561-5860 is the primary intake for New York matters. Examiners are dispatched into the five boroughs, Westchester and Long Island on a 24/7 basis for active incidents. Working meetings are held on site at counsel's offices, at the client site, or by video.
Which New York courts do you work in?
Examiners have prepared reports and given expert testimony in New York State Supreme Court across the five boroughs plus Nassau, Suffolk and Westchester, and in the Southern and Eastern Districts of New York. Reports are also prepared for arbitration under AAA and JAMS, and for regulator-facing matters at NYDFS, the New York Attorney General and the SEC and CFTC New York offices.
How fast can you get on site for a breach in the five boroughs?
For active incidents in Manhattan, Brooklyn, Queens, Bronx and Staten Island, an on-site response is typically dispatched within a few hours of the initial call. Remote preservation of cloud tenants and endpoint telemetry starts on the call itself so that data that rotates on a short cycle, for example EDR process telemetry and mailbox audit logs, is captured before it ages out.
Do you handle NYDFS 23 NYCRR 500 penetration testing?
Yes. The engagement is scoped to the covered entity's information systems as defined in 500.1, and the testing program is documented against the annual penetration test and biannual vulnerability assessment cadence in 500.5. Deliverables are organized so the CISO can hand the report to internal audit, the board committee that receives the 500.4 CISO report, and, where relevant, the DFS examiner.
Can you take a matter that already has another expert on it?
Yes. Neutral, rebuttal and court-appointed engagements are a regular part of the practice. In a rebuttal posture, the starting point is a documented review of the opposing expert's method, tooling and workpapers against accepted practice, and a written record of what can and cannot be reproduced from the underlying data.
Do you work on private-party matters or only corporate ones?
Both. Corporate matters (internal reviews, employment disputes, trade-secret protection, incident response, regulator-facing work, transactional diligence) are the majority. Private-party work is limited to matters where the technical questions and evidence sources are the same, for example high-net-worth probate and estate matters and civil disputes over data or intellectual property. GDF does not take divorce or custody matters.
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189