Digital Forensics & Litigation
Preserve and examine evidence, manage discovery, or find an expert for a business dispute.
Explore forensic and litigation servicesTechnical services
Digital forensics, cybersecurity and OT security
Find the digital evidence your case needs, prepare clear expert testimony, or uncover security weaknesses before attackers do. GDF brings experienced specialists and practical tools to the work.
Choose the right specialist for the work
Algorithmic-bias, biometric-comparison, RF/wireless and specialized hardware opinions require the relevant qualified practitioner, data and method. Each service scope confirms the assigned role, supported sources and any separate laboratory or vendor coordination.
Ask about the experience and methods needed for your particular system or dispute. The relevant service page explains the work; a consultation confirms access, the assigned specialist and the next step. National coverage does not mean every device or method is supported, and no examination guarantees a finding or legal result.
Find the work you need
Enterprise Cybersecurity
Scope a penetration test, assess industrial systems, review code, or prepare for an incident.
Explore cybersecurity servicesEngagement paths
How we can help
Start with the help you need. Our specialists will work with you to define the scope, timing and next steps.
Counsel and litigants
Courtroom-ready technical foundations
Find the evidence that helps explain your case. GDF collects and analyzes computers, phones, email and cloud data, builds clear timelines and prepares findings your litigation team can use.
Our experts prepare reports, review opposing opinions and explain complex technology in deposition, hearings and trial. Documented methods and chain of custody support the evidence from collection through testimony.
- Digital forensics and expert witness testimony
- eDiscovery data preservation and collection
- Neutral, rebuttal and court-appointed examinations
Professional boundary: GDF provides technical analysis and expert opinions. GDF does not provide legal advice or determine litigation strategy. Admissibility remains a matter for the court.
CISOs and IT managers
Validated attack paths and remediation evidence
Human-led penetration testing traces adversarial attack paths through internet-facing services, internal networks, identity systems, cloud control planes, applications and APIs. A practitioner reproduces each material finding before it enters the report.
Findings are ranked for material risk reduction rather than scanner severity alone. Vulnerability remediation guidance identifies the affected asset, exploit preconditions, business consequence, control owner, recommended fix and retest evidence. Incident readiness planning covers authority, escalation, preservation, communications and technical decision points.
SCADA and OT operators
Control-system findings and operational risk
Passive-first asset discovery establishes device, protocol, firmware, zone and communication context before any active step. Network segmentation validation checks whether documented IT/OT boundaries, remote-access paths and vendor connections behave as designed.
ICS security architecture review ties findings to safety, availability, recovery and process constraints. Operational consequence ranking puts credible process impact ahead of generic severity. NERC CIP compliance audit evidence is organized around the applicable requirement, source record, observed control, exception and remediation proof.
- Critical infrastructure and OT security
- OT, ICS and SCADA security assessments
- OT incident response and evidence preservation
Professional boundary: GDF documents technical controls and audit evidence. GDF does not provide legal or regulatory advice or determine compliance status.
Service map
Select the service
Explore the services below, or get a free consultation to discuss your case, project or security concerns.
01
Digital Evidence & Litigation Support
Preserve source material, maintain a defensible chain of custody and explain the technical record for litigation, arbitration, regulatory proceedings or internal review. The work is organized for independent reproduction and expert challenge.
- Mobile Device ForensicsForensic preservation and analysis of iPhone, Android, tablet and application data for litigation, internal review and incident response.
- Computer, Email & Cloud ForensicsDefensible computer, email and cloud forensic analysis for disputes, internal review, fraud, IP theft and cyber incidents.
- eDiscovery Collections & ProcessingDefensible eDiscovery identification, preservation, collection, processing and production support for complex litigation and regulatory matters.
- Email & Microsoft 365 ForensicsPreserve and analyze native email, mailbox, account activity, identity, and endpoint records for authenticity, eDiscovery, and account compromise work.
- Cloud & SaaS ForensicsForensic preservation and analysis of Microsoft 365, Google Workspace, AWS, Azure, Slack, Teams, and supported SaaS. Identity and content correlation.
- Trade Secret & Employee ForensicsForensic examination of suspected trade secret theft, employee data exfiltration, policy violations and disputed departures.
- Departing Employee Forensic AnalysisPreserve devices, cloud accounts, and access history before offboarding rewrites the record. File-transfer, USB, and personal-cloud analysis for counsel.
- Computer Forensics Expert WitnessParty-retained computer forensics expert witness reports, deposition preparation and trial testimony in state and federal courts.
- Expert Witness & Neutral ExaminationsIndependent digital forensics expert witness, rebuttal, neutral examiner and court-appointed technical examination services.
02
Cybersecurity & Adversarial Testing
Measure how realistic adversarial attack paths cross network, identity, cloud and application controls. Findings are validated by a practitioner, ranked for material risk reduction and paired with remediation and retest evidence.
- CybersecurityIndependent cybersecurity assessments that connect technical controls, evidence, business consequence and a prioritized plan for reducing risk.
- Vulnerability AssessmentsEvidence-based vulnerability assessments for networks, cloud services, identities and applications, with validation and prioritized remediation guidance.
- Penetration TestingHuman-led penetration testing for external, internal, identity, network and cloud attack paths, with validated findings and practical retesting.
- Application Penetration TestingManual and tool-assisted penetration testing for web applications, APIs and supported mobile clients, including business logic and access control.
- Application & Source Code Security ReviewHuman-led application and source-code security review across web, API, mobile backend, and desktop. Authorization, isolation, and dependency analysis.
- AI-Powered Penetration TestingHuman-led penetration testing that uses approved AI tools to expand test coverage, correlate evidence and retest findings within defined rules.
- AI Security ConsultingAI governance and risk assessment, model and application red teaming, and secure implementation review for AI-enabled systems.
- NYDFS 500 Technical Evidence SupportTechnical evidence for 23 NYCRR Part 500: asset scope, testing, access, logging, and incident response prepared for audit and DFS examiner review.
03
OT, ICS & SCADA
Map assets and trust paths with a passive-first method, validate segmentation within operator-approved limits and rank findings by operational consequence. Safety, availability and recoverability remain part of the technical scope.
- OT, ICS & SCADA Incident ResponseOT incident response and digital forensics for ICS and SCADA systems, with safety, availability and evidence preservation built into the method.
- OT, ICS & SCADA Security AssessmentsSafety-conscious OT cybersecurity assessments for ICS and SCADA architecture, segmentation, remote access, asset visibility and incident readiness.
- Maritime OT Cybersecurity AssessmentFacility assessment, safe control validation and cybersecurity plan-readiness support for covered maritime operations.
- Utility OT Assurance and Forensic ReadinessIndependent IT and OT boundary evidence, recovery review and forensic response readiness for utility operators.
- OT Asset Discovery (Passive-First)Passive-first OT asset discovery: PLC, HMI, historian, and network device inventory reconciled against operator knowledge and engineering records.
- Network Segmentation ValidationValidate where the network boundary holds: zones, conduits, remote access, and dual-homed hosts compared with design intent through configuration.
- NERC CIP Audit Evidence SupportTechnical evidence support for NERC CIP: asset scope, ESP records, identity control, incident and recovery evidence organized for Regional Entity audit.
04
AI, Identity & Media
Examine whether a person, recording or digital artifact is consistent with its claimed source and history. Conclusions draw on provenance, metadata, signal characteristics and corroborating records, with confidence and limits stated in writing.
05
Incident Response & Resilience
Preserve volatile evidence while containment and recovery move forward. The response record documents entry, persistence, affected systems, potential data access, material decisions and the facts that remain unresolved.
- Ransomware & Data Breach AnalysisIndependent ransomware and data breach forensic analysis, evidence preservation, timeline reconstruction and technical reporting.
- Forensic Readiness & Incident Response PlanningForensic readiness assessments, incident response plans, evidence-retention design, tabletop exercises and response retainer preparation.
- Privacy Incident Technical SupportIndependent technical fact development for privacy incidents, data breach assessment, notification analysis and regulatory response support.
06
Computer, Drive & Network Forensics
Choose the page that matches the source and question: a device or account examination, a discovery workstream, a specialist opinion or an authorized security assessment. Related services have different access, methods and deliverables.
- Computer & Digital ForensicsComputer forensics for litigation, incident response and internal matters, with documented preservation, analysis and reporting.
- Computer & Hard Drive ForensicsForensic imaging and analysis of computers, hard drives, SSDs, servers and removable media for disputes, incidents and internal review.
- Evidence-Aware Data RecoveryEvidence-aware recovery from failed hard drives, SSDs, flash media and storage arrays, with source protection and documented handling.
- Network ForensicsNetwork traffic, packet capture, firewall, DNS, VPN and flow-record analysis for breach reconstruction, disputes and response.
- IT ForensicsEnterprise IT forensic analysis across endpoints, servers, identity, virtualization, cloud and network systems for complex matters.
07
Hardware & AI Evidence
Vehicle systems, embedded devices, integrated circuits and AI records require different collection and examination methods. Choose the service that matches the source you need examined.
- AI ForensicsForensic analysis of AI-generated media, model activity, prompts, outputs and provenance for disputes, fraud and authenticity questions.
- Automobile & ECU ForensicsVehicle forensic acquisition and analysis of event, infotainment, telematics, navigation, pairing and electronic control-unit data.
- Embedded Systems ForensicsForensic acquisition and analysis of embedded devices, firmware, flash memory, interfaces and connected-device artifacts.
- Integrated Circuit ForensicsIntegrated circuit analysis for component failure, counterfeit detection, hardware integrity, patent and product-liability disputes.
08
eDiscovery Workstreams
Collection, legal holds, review and production require different inputs and produce different records. Choose the discovery service for the stage your matter has reached.
- eDiscovery Cloud CollectionsDocumented eDiscovery collection from Microsoft 365, Google Workspace, Slack, cloud storage and other supported SaaS platforms.
- Corporate eDiscovery ServicesCorporate eDiscovery support for legal holds, source mapping, defensible collection, processing, review and repeatable response workflows.
- eDiscovery Data Discovery & Source MappingeDiscovery data discovery and source mapping across custodians, cloud tenants, collaboration tools, repositories and business systems.
- eDiscovery Early Case IntelligenceEarly case intelligence using deduplication, threading, search testing, communication analysis and volume reporting before full review.
- eDiscovery Services for Law FirmsTechnical eDiscovery support for law firms, including protocols, preservation, collection, processing, review support and production.
- eDiscovery Legal Hold SupportTechnical legal-hold support for custodian tracking, source preservation, cloud retention, collection readiness and auditable exceptions.
- eDiscovery Managed ReviewManaged document review support with review protocols, team calibration, privilege workflows, quality control and progress reporting.
- Mobile & Endpoint eDiscovery CollectionsTargeted and forensic eDiscovery collection from phones, tablets, computers and supported endpoints with documented integrity.
- eDiscovery Production ServiceseDiscovery production preparation for native, image and text deliverables, metadata, load files, redactions and reconciliation.
- eDiscovery Review PlatformSecure eDiscovery review workspaces for search, coding, privilege, redaction, modern communications and matter reporting.
- eDiscovery Security & ComplianceSecurity and privacy controls for eDiscovery data handling, access, transfer, hosting, audit records, retention and incident response.
- Structured Data eDiscoveryStructured-data discovery, extraction and normalization from databases, ERP, CRM, financial and custom business systems.
09
Specialized OT, ICS & SCADA
Choose industrial forensic analysis, an architecture assessment, vulnerability management or operator-approved testing. Each service defines the work and the precautions needed to protect operations.
- ICS Penetration TestingOperator-approved ICS penetration testing for control networks, industrial protocols, remote access and IT-to-OT attack paths.
- OT, ICS & SCADA ForensicsForensic preservation and event reconstruction across control systems, engineering workstations, historians, HMIs and industrial networks.
- OT Network AssessmentPassive-first OT network assessment covering assets, protocols, segmentation, remote access, trust paths and operational exposure.
- OT Vulnerability ManagementRisk-based OT vulnerability management tied to asset context, exposure, compensating controls, process consequence and maintenance windows.
- SCADA Security TestingSCADA security testing for control servers, HMIs, engineering stations, remote access, segmentation and industrial protocol exposure.
- IoT Security AssessmentIoT security assessment across device hardware, firmware, applications, APIs, wireless interfaces and supporting cloud services.
10
AI & Application Security
Architecture, source and adversarial testing pages distinguish design review from code analysis and full-system security validation.
- AI Security ArchitectureSecurity architecture review for AI applications, models, data pipelines, RAG systems, agents, MLOps and third-party components.
- AI Security TestingTechnical security testing for AI and LLM systems, including prompt injection, data exposure, tool misuse and authorization failures.
- Source Code Security ReviewManual and tool-assisted source code security review for exploitable flaws, trust-boundary errors, insecure data handling and due diligence.
11
Expert Testimony by Subject
Subject-specific expert work connects the technical record to a stated method, reproducible workpapers and testimony bounded by the available evidence.
- AI Expert WitnessNational AI expert witness: model provenance, algorithmic bias, training-data disputes, deepfake authentication and FTC AI enforcement matters.
- Biometrics Expert WitnessNational biometrics expert witness for federal court and MDL: face, fingerprint, voice and iris, BIPA class actions and ITC 337 IP matters.
- Cloud and SaaS Expert WitnessNational cloud and SaaS expert witness: FRCP 34 disputes, multi-tenant preservation, Microsoft 365 and AWS forensics for federal court and MDL.
- Database Expert WitnessNational database expert witness: Independent database analysis and technical preparation support, transaction-log analysis and Oracle, SQL Server, PostgreSQL and cloud DB disputes.
- Source Code Expert WitnessNational source code expert witness: patent Markman and infringement, DTSA trade-secret matters and ITC 337 review under E.D. Tex. and N.D. Cal.
- Technology Expert WitnessNational technology expert witness for federal court, MDL and enterprise IT disputes: architecture, integration and contract-performance testimony.
- Wireless Technology Expert WitnessNational wireless expert witness for federal court and ITC 337: LTE and 5G SEP, cellular protocol testimony, Wi-Fi 6/6E/7 and Bluetooth LE.
12
Connected and Emerging Evidence
These services explain what can be collected from connected devices, transaction systems and media, how it is checked and where interpretation is limited.
- Cryptocurrency ForensicsNational cryptocurrency forensics: blockchain tracing, wallet analysis, exchange-record review and documented expert reports on BTC, ETH and other chains.
- Vehicle ForensicsNational vehicle forensics: Ford Sync, Uconnect, CarPlay, Android Auto, telematics, ECU and CAN bus data and Tesla vehicle log analysis.
- Drone and UAV ForensicsNational drone and UAV forensics: flight-log analysis, DJI DAT and TXT records, controller and mobile app extraction, aviation evidence for litigation.
- IoT and Smart Home ForensicsNational IoT and smart-home forensics: Amazon Alexa, Google Home, Ring, Nest, smart TVs and Matter and Thread protocols with cloud-device reconciliation.
- Wearable Device ForensicsNational wearable device forensics: Apple Watch, Fitbit, Garmin, Whoop and Oura, plus HealthKit and Google Fit exports for civil and criminal matters.
- Deepfake Detection and AuthenticationNational deepfake detection and authentication: synthetic media analysis, C2PA verification and testimony under FRE 901 and 902.
- Mainframe Security and ForensicsNational mainframe security and forensics: z/OS, RACF, ACF2, SMF audit analysis, IMS, DB2 for z/OS and CICS for enterprise and enforcement matters.
Integrated practices
Seven practice areas, one documented record
Practice pages set out the engagement model, methodology, deliverables and related disciplines for matters that cross more than one service.
- 01Digital Forensics & Expert WitnessTechnical support for court-admissible digital forensics, defensible chain of custody, eDiscovery data preservation and expert witness testimony.
- 02Biometrics & Identity SciencesIndependent biometric and identity evidence examination: fingerprint and facial comparison, biometric system review, and courtroom admissibility support.
- 03Critical Infrastructure & OT SecurityPassive-first OT asset discovery, ICS security architecture and network segmentation validation, with consequence ranking and NERC CIP audit evidence.
- 04Cyber Due DiligenceFixed-fee cyber due diligence for acquisitions, covering security maturity, breach history, dark web exposure and regulatory risk on the deal timeline.
- 05Executive Cyber Risk AdvisoryFixed-fee board cyber risk assessment: risk ranking, insurance gap review, vendor risk review, incident readiness and a board-ready briefing.
- 06AI & Deepfake AnalysisDeepfake detection, voice verification, video authenticity and AI content analysis, with metadata examination and expert testimony on synthetic media.
- 07Incident Response & Retainer ProgramsSilver, Gold and Platinum incident response retainers: 24/7 hotline, priority response, forensic hours, tabletop exercises and board-level reporting.
Talk with an examiner
Discuss the matter and the next step.
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189
Email collection, authentication and account takeover
- Business Email Compromise Analysis: Someone used your business email or changed payment details? GDF analyzes Microsoft 365 email and account records to help explain what happened.
- Email & Microsoft 365 Forensics: Remote Outlook and Microsoft 365 email collection, authentication, tracking and eDiscovery. Preserve email, cloud files and account activity with GDF.
- Gmail & Google Workspace Forensics: Gmail and Google Workspace forensic collection, authentication and eDiscovery. Preserve email, Google Drive files and available activity logs with GDF.
- Business Email Takeover Forensics: Hacked email account? GDF analyzes Microsoft 365 and Gmail compromise, phishing, data access, forwarding and persistence for counsel and responders.
GDF Core Analysis: departures and business separations
A flat-rate forensic examination for the agreed scope, with evidence preservation and an activity timeline that business leaders and counsel can understand.
- Employee Exit Core Analysis: Did an employee take proprietary information? GDF Core Analysis preserves evidence and explains computer, email, cloud and AI activity at a flat rate.
- Executive Departure Core Analysis: GDF Core Analysis examines executive computer, email, cloud and AI activity. Flat-rate forensic preservation and clear reporting for leadership.
- Business Partner Separation Core Analysis: GDF Core Analysis preserves records when business partners separate. Flat-rate forensic examination of email, files, cloud storage and AI activity.
Continuous AI Penetration Testing
Explore continuous AI penetration testing for public-facing applications, services and APIs, with human-reviewed attack plans and validated findings.
Expert witness services by evidence and technology
OT assessment and readiness guidance
Water & Wastewater Cybersecurity Assessment
Treatment operations, vendor access, recovery and evidence for the applicable program.
Prepare for a Maritime Cybersecurity Assessment
Organize the operating boundary, responsible people, records and testing safeguards.
Maritime Assessment Deliverables Preview
See how scope, evidence, findings, corrective actions and recovery records fit together.