Microsoft 365, Google Workspace, AWS and SaaS Expert Testimony
Cloud Expert Witnesses on What the Provider Really Retained
When the evidence lives in a tenant rather than on a hard drive, the fight is over what the provider kept, what the license allowed and when the hold went in. We reconstruct the tenant as it stood at the relevant time, from audit configuration and retention policies to sign in, sharing and deletion events, and reconcile it against what was produced. Every figure in our reports traces to a query another examiner can rerun, and our experts have testified in federal and state courts.
Why Litigation Counsel Retain Global Digital Forensics for Cloud Testimony
Cloud records are unforgiving in one respect: they exist only as long as the configuration says they do. A Microsoft 365 audit entry, a Google Drive log event or an AWS CloudTrail record is available for a defined window, under a defined license, with a defined set of events enabled, and once that window closes no subpoena brings it back. Our examiners have testified in federal and state courts, and their opinions describe the tenant that existed at the relevant time rather than the product brochure.
Joseph Caruso founded the firm in 1992, and his technology career, which began in 1980, runs from mainframe databases and real time transaction systems to cybersecurity incident response. That is the background a cloud dispute demands when the question is how an authentication event, a sharing change and a deletion relate to one another across three providers. The practice most often serves Fortune 1000 and AmLaw 100 clients, and it works for plaintiffs and defendants alike.
The field definitions our opinions rest on are public. Review Microsoft audit activity definitions, Google Drive log events and AWS CloudTrail data events for the technical background behind our reports.
If the fight is already over what the tenant retained and when the hold went in, describe the platforms and the schedule and we will say what the retained records can establish before you commit to an opinion.
The engagement
What Was Retained, What Was Collected, What Was Lost
Every cloud opinion starts with the environment: the provider, the tenant edition and license, the authorized role used for collection, the audit sources that were enabled, the retention policies in force and the export or API version that produced the records. A platform name such as Salesforce, ServiceNow or Workday says nothing about which objects and historical actions were kept, and an E5 license describes capability rather than what was actually turned on.
With the environment fixed, we compare the preservation notices and litigation holds against the tenant configuration timeline and the records the provider still held at the collection date. For each source the opinion states what was available, what was collected and what evidence supports an earlier retention window or a later loss. That source by source account gives counsel a defensible basis for a production dispute or an FRCP 37(e) analysis, and it gives the court something firmer than competing assertions.
We preserve the original provider exports, the query and job records, the parameters and every transformation, so another qualified examiner can repeat the analysis from the retained record. Where a live acquisition can no longer be repeated, the retained exports and job records carry the verification instead, because the opinion that can be checked is the one that survives cross examination.
The first call settles who would reconcile the counts and who would testify to them, and the examiner's background comes with that answer.
Scope
Preservation and production coverage
We review preservation notices, tenant exports, retention changes, connector activity and the produced records to establish the technical timing and coverage of a production. The findings feed directly into FRCP 26, 34 and 37(e) briefing.
Microsoft 365 and Entra
We examine unified audit records, mailbox retention, message traces, sign in and identity protection records, inbox rules, OAuth consents and administrative changes, and we compare what an E5 license could have captured with the audit configuration that was actually in operation during the relevant period.
Google Workspace
We examine Drive, Gmail and admin log events, Vault retention and holds, sharing changes and third party application access, read against the retention Google actually applied to that edition at the time rather than the retention a later administrator assumed.
AWS, Azure and cloud infrastructure
Infrastructure analysis covers CloudTrail management and data events, S3 access logs, Athena queries over retained archives, Azure Activity and historical sign in exports, IAM policy history, KMS audit records and retained network flow logs, each confirmed against the actual platform access and coverage.
Salesforce, ServiceNow and enterprise SaaS
We examine field history, Setup audit records, Event Monitoring, integration users, connected application grants and API production, and we confirm which objects and records the platform actually supported and retained rather than assuming a product name establishes complete history.
Slack, Teams, Zoom and collaboration platforms
Collaboration review covers workspace exports, channel and direct message coverage, retention overrides and connector activity, including Teams eDiscovery exports and Zoom cloud recording and audit retention where available, with custody documented across every export tool.
Timeline correlation, rebuttal and motion support
We correlate sign in, mailbox, content, sharing and endpoint events on one normalized timeline with provider identifiers and time zone conventions stated, review the opposing expert's cloud report and prepare rebuttal declarations and questions for cloud fact witnesses and administrators.
Methodology
From Retention Settings to the Witness Stand
-
Define the expert role and the cloud sources
We confirm the retention letter, run conflicts across providers and connected applications, and fix the source scope, review period, license and audit configuration in writing, so the assignment addresses the tenant in the case rather than the cloud in general.
-
Compare preserved sources with produced records
We reconcile preservation notices, tenant configuration and the produced material with the provider's retention at the collection date, and we document every gap by source and date so nobody has to guess at it.
-
Write the report for FRE 702 scrutiny
The report explains what was retained and collected, what expired and how the events correlate, with each opinion tied to its artifact and query so another qualified examiner can evaluate the basis and the trial team can prepare for Daubert or Frye scrutiny.
-
Deposition, Evidentiary Hearing, and Trial Testimony
The examiner who did the work prepares with counsel and testifies at deposition, hearing and trial within the report's scope, in person or remotely where the tribunal permits. Workpapers are retained for agreed later review, including appellate support.
To see how an examination moves from preservation to the witness stand, walk through the digital forensics process guide, then bring the tenant details to a first call.
Evidence commonly examined
Cloud Evidence We Examine
Tenant configuration and license exports from Microsoft 365, Entra and Google Workspace establish the environment under review, and CloudTrail archives, S3 access logs and Athena query records carry the infrastructure analysis. Slack, Teams and Zoom exports preserve the collaboration and audit records that survived, and Salesforce Setup audit records, field history and Event Monitoring supply the platform activity in scope. Preservation notices and litigation hold configuration show what was instructed and what was implemented, the opposing expert's reports, workpapers and tool output give us something concrete to test, and the court's orders, protective orders and ESI protocols define how all of it may be handled and produced.
What you can expect
Expert Reports, Rebuttal and Testimony
You receive a technical report that explains preservation timing, scope and production coverage, an event timeline that correlates every source with its time zone conventions stated, and a reproducibility appendix recording queries, ranges, counts and checksums so the retained record can be reconciled by anyone who doubts it. Where the matter calls for it we add a rebuttal declaration on the opposing cloud expert's report, a technical declaration supporting the FRCP 37(e) analysis, and deposition and trial testimony within the scope of the report.
If a reproducibility appendix and an FRCP 37(e) declaration are what your motion needs, request a written scope that names the sources, the ranges and the deliverables.
Frequently asked
What to Know Before Retaining a Cloud Expert
Does an E5 license mean the audit record exists for the relevant period?
No. E5 describes capability. Whether a record exists depends on the audit configuration that was enabled, the retention applied, the age of the event and any provider changes since. Our report identifies what was actually available at collection rather than assuming license capability establishes historical coverage.
Do you take FRCP 37(e) spoliation work for plaintiffs and defendants?
Yes, for either side. The technical work is grounded in tenant configuration, retention settings and provider records, and it reads the same whichever party retained us. We establish what was held, when, and what became of it, which is the factual record a 37(e) motion is argued on.
Can you testify on Salesforce or ServiceNow evidence, not just Microsoft 365 and Google Workspace?
Yes. We examine Salesforce field history, Setup audit records and Event Monitoring, ServiceNow and Workday audit records and comparable enterprise platforms, and the report identifies what each platform actually preserved for the objects in dispute and what would require additional production.
What happens when the tenant was migrated or the provider changed during the relevant period?
Migrations and provider changes go on the tenant configuration timeline. The report states which records survived the migration intact, which were transformed in transit and which cannot be recovered because nobody preserved them before the move, so it is clear which gaps are explainable and which are not.
Can your expert appear in ITC 337 or other proceedings involving cloud technology?
Yes. The practice's experience spans federal district court, multidistrict litigation, arbitration and ITC Section 337 proceedings. We confirm the assigned examiner's relevant experience and availability during scoping, and every appearance follows the tribunal's rules and the terms of the retention.
Talk with an examiner
Plan your cloud expert engagement
Tell us the platforms, the evidence and the deadline. We review experience, conflicts and scope before any engagement, and the first consultation is free.
Federal district court, multidistrict litigation, arbitration and ITC Section 337 experience, answered 24/7.
Talk with an examiner
Retain a Cloud Expert Who Can Explain the Tenant
On the first call a senior examiner asks which providers, editions and licenses are involved and when the hold went in, then tells you which audit records may still be inside their retention window and what to preserve this week. The consultation is free.
Our 24/7 hotline is (800) 868-8189.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .