Forensics, eDiscovery, Expert Testimony, Penetration Testing and OT Security
A dispute turns on a deleted file, a phone or a cloud account, or a network, a plant or an aircraft system has to be tested before someone else tests it. This catalog lists every service Global Digital Forensics offers, grouped by the problem that brings attorneys, executives and operators to us. If you cannot tell which one fits, a senior examiner will sort it out with you on a free first call.
A departed employee's laptop, a disputed email thread, a penetration test of a customer facing application and a SCADA assessment each call for different expertise, and so do biometric comparison, wireless and specialized hardware opinions. Every engagement starts by matching the technical question to the practitioner, the data and the methods it requires, and the engagement letter names the assigned examiner and the sources in scope so nothing surprises you in discovery.
Global Digital Forensics has served law firms and businesses since 1992, including AmLaw 100 firms and Fortune 1000 companies, and its examiners have testified in federal and state courts. Joseph Caruso, the founder, brings software, database and incident response experience; Veronica Perez brings mobile and vehicle evidence experience and has been designated an expert witness in state and federal courts; Robert Knudsen combines computer forensics with cybersecurity and network operations. The free first consultation settles which of them, or which specialist, fits your matter.
The initial consultation is free, and a senior specialist sets the scope with you on the first call.
Someone deleted the files, took the client list or disputes what an email says, and you need the evidence preserved, examined and explained by an examiner who has testified before.
Explore forensic and litigation servicesYour network, applications, industrial controls or AI systems need to be tested before an attacker does it for you, with every finding validated by a practitioner rather than a scanner.
Explore cybersecurity servicesEngagement paths
Start with the help you need. A specialist, not a salesperson, works with you to define the scope, the timing and the next step, and the first consultation is free.
Attorneys and litigants
Someone deleted the files, took the client list or disputes what a message says. Global Digital Forensics collects and analyzes computers, phones, email and cloud data, builds clear timelines and prepares findings your litigation team can put in front of a judge.
Our experts write the reports, review the opposing opinions and explain complex technology in deposition, at hearings and at trial, and we have done so in federal and state courts. Documented methods and an unbroken chain of custody support the evidence from collection through testimony.
You get the technical analysis and a qualified opinion early enough to shape the case strategy, not just to defend it.
CISOs and IT managers
You need to know whether an attacker can get in before one does. GDF testers trace attack paths through internet facing services, internal networks, identity systems, cloud control planes, applications and APIs, and a practitioner reproduces each material finding before it enters the report.
Findings are ranked for the risk they actually remove rather than for scanner severity. Each one names the affected asset, the exploit preconditions, the business consequence, the control owner, the recommended fix and the retest evidence, and our incident readiness planning covers authority, escalation, preservation, communications and the technical decision points you will face at two in the morning.
SCADA and OT operators
A plant cannot be scanned like an office. Passive asset discovery establishes device, protocol, firmware, zone and communication context before any active step, and we validate whether documented IT and OT boundaries, remote access paths and vendor connections behave as designed within the limits the operator approves.
Industrial control system architecture review ties every finding to safety, availability, recovery and process constraints, ranks credible operating consequences ahead of generic severity and organizes NERC CIP audit evidence around the applicable requirement, the source record, the observed control, the exception and the remediation proof.
You get the technical controls and audit evidence organized the way your compliance team and auditors expect to read them.
If you are reading this as an attorney, as a CISO or as an operator and the right path is still unclear, tell us what happened and a specialist, not a salesperson, will call you back promptly.
Service map
Each entry names the service and the situation it is built for. Open the one that matches yours, or call and let a senior examiner point you to it.
A dispute turns on what a computer, a phone, a mailbox or a cloud account actually recorded. These services preserve the source, keep an unbroken chain of custody and explain the technical record for litigation, arbitration, regulatory proceedings or internal review, organized so another examiner can reproduce every step.
Call (800) 868-8189 to talk it through with an examiner, or send the details.
Your controls look fine on paper until someone tries to cross them. These services measure how real attack paths move through network, identity, cloud and application controls, with every finding validated by a practitioner, ranked for the risk it actually removes and paired with remediation and retest evidence.
An industrial network cannot be tested the way an office network is. We map assets and trust paths through passive observation, validate segmentation within limits the operator approves and rank every finding by its operational consequence, so safety, availability and recoverability guide the technical scope. The same discipline covers aircraft, rail, vessels, traffic systems and large surveillance installations.
Send the question and the sources you know about, and we will map the examination with you.
A recording, an image or a claimed identity is only as good as its provenance. These services examine whether a person, a recording or a digital artifact is consistent with its claimed source and history, drawing on metadata, signal characteristics and corroborating records, with the confidence of each conclusion stated in writing.
The hours after a breach decide what you will ever be able to prove about it. These services preserve volatile evidence while containment and recovery move forward and build the response record that documents entry, persistence, affected systems, potential data access and the material decisions along the way.
A senior examiner can walk through the facts of your matter on a free call.
Choose the source and the question. Each service page sets out the access requirements, methods and deliverables, and a call settles which one fits.
Vehicle systems, embedded devices, integrated circuits and AI records do not give up their evidence through a standard extraction. Each of these services uses the collection and examination methods the source demands.
Describe the devices and the deadline and the first call sets the plan.
Collection, legal holds, review and production require different inputs and produce different records. Choose the discovery service for the stage your matter has reached, and we bring the internal tools that keep unnecessary material out of review.
Choose industrial forensic analysis, architecture assessment, vulnerability management or operator approved testing. Each service identifies the technical work and the precautions that keep operations running while it is done.
Tell us what happened and when, and a senior examiner will say which sources to secure first.
Architecture, source code and adversarial testing answer different questions. Choose a design review, a code analysis or validation against the running system, or combine them when the stakes justify it.
A specialist in the disputed subject connects the technical record with a stated method, reproducible workpapers and testimony supported by the available evidence. These practices most often serve Fortune 1000 and AmLaw 100 clients in federal court, multidistrict litigation, arbitration and ITC proceedings.
Ask an examiner how this applies to your matter; the first consultation is free.
Cars, drones, wearables, smart speakers, blockchains and mainframes all keep records. These services explain what can be collected from each and how it is checked.
If none of these entries names your situation exactly, the cybersecurity and forensics glossary defines the terms and points to the service behind each one.
Integrated practices
Practice pages set out the engagement model, the methodology, the deliverables and the related disciplines for matters that cross more than one service.
Business Email Compromise Analysis examines Microsoft 365 email and account records when business email was misused or payment details were changed, so you know what happened before you decide what to do about it.
Email & Microsoft 365 Forensics provides remote Outlook and Microsoft 365 collection, authentication, tracking and eDiscovery, preserving email, cloud files and account activity before the audit logs expire.
Gmail & Google Workspace Forensics provides Gmail and Google Workspace collection, authentication and eDiscovery, preserving email, Google Drive files and the available activity logs.
Business Email Takeover Forensics traces a Microsoft 365 or Gmail compromise through the phishing, the data accessed, the forwarding rules and the persistence the attacker left behind, for IT leaders and incident responders.
Unsure whether your mailbox problem is a disputed message or a live compromise? Call the 24/7 hotline at (800) 868-8189 and an examiner will say which examination fits before the logs age.
GDF Core Analysis is a forensic examination at a flat rate for an agreed scope. It preserves the evidence and delivers an activity timeline that business leaders can understand without a translator.
Employee Exit Core Analysis preserves the evidence and explains computer, email, cloud and AI activity when an employee may have taken proprietary information on the way out.
Executive Departure Core Analysis examines an executive’s computer, email, cloud and AI activity with forensic preservation and clear reporting when the stakes of the departure are higher.
Business Partner Separation Core Analysis preserves email, file, cloud storage and AI activity records when business partners separate and each side needs to know what the other did with the shared data.
If your public applications and APIs change every sprint, continuous AI penetration testing keeps the test current, with every finding validated by a tester before it reaches your report.
The first conversation is free and starts the scope with you. Request it now.
Assess treatment operations, vendor access, recovery and evidence against the requirements that apply to your water or wastewater operation.
Organize the operating boundary, the responsible people, the records and the testing safeguards before planning a maritime assessment.
See how assessment scope, evidence, findings, corrective actions and recovery records fit together before deciding which deliverables your operation needs.
Free initial consultation
On the first call a senior examiner or security lead will tell you which service fits, what it will take, how long it will run and what you will receive at the end. The consultation is free and handled in confidence.
Our 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .