One Examination Across the Laptop, the Mailbox and the Cloud
Computer, Email and Cloud Forensics in One Examination
A document is edited on a laptop, synced to OneDrive, attached to an email and shared with an outside account, and no single source tells that story. Global Digital Forensics examines the computer, the mailbox and the cloud together and connects them into one timeline a court can follow, with a custody record behind every entry.
Where Single Source Examinations Leave Holes
A departure, a disputed contract and an intrusion all leave records in more than one place. A team that collects the laptop but not the mailbox, or the mailbox but not the cloud audit log, inherits holes the other side will find first. We collect and examine the computer, the email and the cloud tenant as one evidence set, so each finding is checked against the sources around it before it reaches a report.
If your question crosses more than one source, get a free consultation and we will tell you whether a flat rate Core Analysis or a wider examination fits.
The engagement
Reconstruct What Happened Across Devices and Accounts
A disputed email. A departing employee. A shared folder of proprietary documents that turned up somewhere it should not be. Global Digital Forensics connects the evidence across computers, messages and cloud accounts to answer the questions that drive your matter: who accessed the information, where it went and what happened next.
We have done this work since 1992 for AmLaw 100 firms, Fortune 1000 companies and small and midsize businesses. Preservation, technical analysis, eDiscovery and expert testimony sit in one engagement, backed by an email practice that has collected thousands of mailboxes, completed hundreds of compromised account analyses and handled hundreds of email related deposition and testimony engagements.
Remote collection lets clients and distributed teams gather evidence with an account holder or an authorized administrator without shipping hardware across the country. Routine email collection usually allows continued use of the account under the agreed preservation and security plan. Computer and mobile collection is arranged around the device and the evidence need, and when a source is live or compromised, containment and source changes are coordinated and documented as they happen.
Start with the question, the people and accounts involved and your deadline. We help you choose the collection and analysis scope, explain the deliverables and agree the cost before anything is engaged.
Scope
Computer forensics and activity timelines
We examine laptops, desktops, servers and forensic images for file activity, browser history, USB connections, login activity and application records, and correlate the traces of creation, modification, copying and deletion into the sequence of events.
Email authentication, tracking and relationships
We analyze messages, headers, attachments, mailbox records and email logs to test authenticity against the original and corroborating records and to trace how a communication traveled. Sender, recipient and timing data build relationship maps that show how people and accounts actually communicated.
Cloud files, sharing and account access
Microsoft 365, Google Workspace, Box and Dropbox hold documents, file versions, sharing activity and account logs. We correlate those records with the computer and email evidence to explain the access, movement and use of information. Explore cloud and SaaS forensic analysis.
Compromised email accounts
Our business email takeover forensic service examines the phishing messages, login activity, forwarding rules and related evidence to establish the entry path, the data reached and whether the intruder’s access persists.
Mobile messages and chats
Connect the computer and account timeline with texts and app conversations through mobile device forensics. Remote collection through a link and a computer connection usually lets the client keep using the phone, which simplifies coordination for everyone involved.
eDiscovery and expert support
Move from preserved evidence to focused review, production and clear expert findings. GDF coordinates collection and analysis with your discovery obligations, reporting needs and case deadlines.
Preserve Microsoft 365 and Google Workspace Before It Changes
GDF forensically collects Outlook, Gmail and email archives together with the relevant documents and activity logs. Preserving the email and the logs early keeps the original messages, attachments and account activity together, so each can later corroborate the others.
Microsoft 365 and Outlook email forensics covers email authentication, tracking, OneDrive and SharePoint collection and Microsoft 365 log analysis.
Google Workspace and Gmail forensics covers Gmail, Google Drive files, sharing records and the available Workspace logs.
Business email takeover forensics addresses hijacked mailboxes, phishing, unauthorized account access and the persistence that outlasts a password reset.
Professional collection preserves the original evidence and its handling history. We coordinate routine remote email collection around the agreed preservation and security plan, so continued account use and the evidence need work together.
Mailbox holds and audit logs expire on separate schedules, so preservation should begin this week, not after the pleadings. Call (800) 868-8189 and we will name the records to hold first.
When Someone Leaves With Company Information
GDF Core Analysis is a flat rate examination for an agreed scope. We preserve the relevant email, documents and computer evidence and build a timeline around the departure of an employee, an executive or a business partner, and the scope can include chats, available AI activity and cloud storage records. The proposal names the people, the sources, the dates and the included report, and any further collection, analysis or testimony is agreed as a scope change before it begins.
Employee exit Core Analysis examines copying, communication and sharing before and around an employee departure.
Executive departure Core Analysis examines sensitive business information and the activity around an executive’s exit.
Business partner separation Core Analysis examines access to company records and the movement of information during a business separation.
The report gives business leaders and their attorneys a plain language view of the activity, with the evidence behind each finding, so the decision to send a demand letter, seek an injunction or let the matter rest is made on the record.
eDiscovery, Reports and Testimony From the Same Examiners
We help counsel define eDiscovery stipulations, relevant sources, keywords and discovery requests, then focus the collection and organize the material for review and production. GDF owns its software and uses its own internal tools for collection, deduplication, standard system file filtering, review and load file preparation, with processing and hosting scaled to the matter so small and midsize businesses can manage discovery within their resources.
Explore eDiscovery collection, processing and production for the discovery question in front of you.
When the findings need an expert voice, GDF prepares reports, affidavits, declarations and exhibits and provides deposition and trial testimony, connecting the technical evidence to the questions judges and juries need to understand in language they follow the first time they hear it.
For a published example, read COMLAB v. Kal Tire, in which Joseph Caruso’s analysis of manipulated document metadata led a federal court to find fabrication and spoliation by clear and convincing evidence and to describe his testimony as reasonable, logical, and ultimately highly credible. Explore expert witness services and meet our forensic experts.
Methodology
How We Examine Devices, Email and Cloud Records Together
Define the questions
We discuss the matter, the people, the devices, the accounts and the deadlines, and agree the sources, collection methods and deliverables so each stage serves the case.
-
Preserve the evidence
We collect the original data and the relevant logs with documented methods, integrity checks and custody records, preserving the evidence and its handling history together.
-
Build a timeline across the sources
We correlate files, messages, login activity and sharing events, align the timestamps and retain the source records behind every entry on the timeline.
-
Explain the findings
We prepare a concise report and exhibits and provide the agreed discovery, affidavit, deposition and testimony support so the technical findings can be put to work.
Our guide Five Mistakes That Destroy Digital Evidence Before We Arrive shows which of these steps most often goes wrong when it is skipped.
To put a senior examiner on this part of the matter, request a free consultation.
Evidence commonly examined
Computer, Email and Cloud Sources We Examine
Computers, forensic images, backups and file histories supply the device and storage record. Outlook, Gmail, archives, headers and attachments supply the original communications and their context. OneDrive, SharePoint, Google Drive, Box and Dropbox records supply the cloud files and the activity around them, while login, sharing and email logs reconstruct account activity and tie the events together. Browser, USB, chat and available AI activity records add context to the sequence, and mobile messages and application conversations connect the device communications to the wider timeline.
What you can expect
Your Report and Case Timeline
Collection and custody records document the material preserved and its handling. The timeline connects the relevant computer, email and cloud activity to its supporting sources. Email authentication, communication maps and file analysis explain the evidence relevant to your questions, the relevant data is prepared for review and agreed production formats so the matter can move into discovery, and the reports, exhibits and agreed expert testimony explain the methods and findings to the legal team and the court.
Plan the Collection and the Report With a Senior Examiner
Tell us what you need to establish, which devices or accounts are involved and your deadline, and a senior examiner will lay out the collection, analysis and reporting plan with you. The initial consultation is free.
Read how our examiners served as database and computer forensics experts in Rogers v. BNSF Railway, then review the examiners who could carry your matter.
Get a Free ConsultationFrequently asked
Before a Combined Computer, Email and Cloud Examination
Can GDF collect and analyze computer, email and cloud evidence together?
Yes. GDF preserves and examines computers, email accounts, cloud files and activity logs, connects the records into one timeline and explains the findings in plain language for attorneys and business leaders.
Can email and cloud data be collected remotely?
Yes. Remote collection is arranged with the account holder or an authorized administrator, and continued use of the account follows the agreed preservation and security plan. We coordinate containment, retention and collection and document any source change as it happens.
Can you tell whether an email is real or altered?
Yes, in many matters. We examine message headers, attachments, mailbox records, email logs and independent copies, and the report shows which records support the conclusion on authenticity.
Can you determine whether an employee took company information?
We examine computer activity, email, cloud sharing, chats and related records to assess how company information was accessed, copied or transferred. Core Analysis preserves the agreed evidence and produces an activity timeline at a flat rate for the defined scope.
Can you analyze a hacked email account?
Yes. Our business email takeover service examines the entry path, the account activity, the data reached, the phishing sequence and the persistence left behind, correlating the login and mailbox records with the messages and related evidence.
Can you help control the cost of eDiscovery?
Yes. We help the legal team focus the sources, keywords and review on the information that matters, and GDF’s own tools handle deduplication, filtering, review and load file preparation, with hosting scaled to the matter and the budget.
Can you prepare a report and provide expert testimony?
Yes. GDF experts prepare reports, affidavits, declarations and exhibits and provide deposition and trial testimony, explaining complex technology in language judges, juries and business leaders can follow.
What should I have ready for the first conversation?
The question you need answered, the people and organizations involved, the kinds of devices and accounts in play and your deadline. We will help define the scope, explain the collection process and arrange secure evidence sharing, and the first consultation is free.
Free consultation
Preserve the Records Your Case Depends On
On the first call a senior examiner hears the question, identifies the computers, mailboxes and cloud accounts that hold the answer, tells you what to preserve this week and outlines the scope, the timeline and the cost.
Since 1992, with a 24/7 hotline and examiners who testify to what they find.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .