Computer Forensics, Digital Evidence and Expert Testimony
The deleted file, the USB drive plugged in at midnight, the email someone changed after it was sent. Global Digital Forensics examiners recover and preserve that evidence from computers, servers and cloud accounts, connect it into one timeline of what happened and defend the findings under oath in federal and state courts. Law firms and companies have relied on our work since 1992, and the initial consultation is free.
Since 1992
Every action on a computer leaves records the operating system keeps on its own: file system entries, registry changes, shortcut files, device histories and deleted data that has not yet been overwritten. Reading those records correctly takes examiners who hold recognized credentials, who have been deposed and cross examined, and who know how a careful insider tries to cover a trail. We shape each examination around the legal question in your matter, from a contested departure handled through our trade secret and employee data theft forensics practice to testimony from a computer forensics expert witness, and we preserve the evidence before routine IT cleanup can overwrite it.
Our examiners hold the CISSP, EnCE, CCE and CHFI credentials, have testified in federal and state courts and have completed hundreds of computer and mobile device examinations for litigation.
Laptops, servers, email and cloud accounts are examined together, so the chronology shows what the whole record supports instead of what one machine suggests.
Every entry in the chronology cites its source record, the findings read in plain English, and the examiner who wrote them explains them in deposition and at trial.
The initial consultation is free, and a senior examiner sets the plan with you on the first call.
A dispute usually centers on one message, one missing folder or one date that looks wrong. The records that settle it sit deeper, where a keyword search never reaches: file system metadata, shortcut and recent item records, USB device histories, registry hives, application logs, identity events and the activity logs that cloud services keep. Our examiners read every one of them, connect them into a single timeline and show what each record proves about who opened, copied, changed or deleted the files at the heart of your matter.
Before any collection we confirm the devices and accounts in scope, the dates that matter, the access arrangements and the questions the report must answer. Every source is imaged and verified with a hash value, and the acquisition record follows the evidence from that first hash forward, so an opposing expert can retrace each step and reach the same result.
The work follows the collection, examination, analysis and reporting process set out in NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, and the examiner who performs the work is the examiner who explains it.
If a keyword search has already come back empty, put the device in front of a senior examiner. The first consultation is free, and on that call we will tell you what an examination can establish and how quickly we can begin.
You need to know what the computer proves, how certain the examiner is and whether the work will hold up when the other side attacks it. Our examination answers those three things in four stages, each documented so another qualified examiner can repeat it. The full method is laid out in our guide How a Forensic Examination Reaches the Witness Stand.
Global Digital Forensics has done this work since 1992. Our expert practice includes federal district court, multidistrict litigation, arbitration and ITC Section 337 matters, and it most often serves Fortune 1000 companies and AmLaw 100 firms. The same discipline applies whether the evidence sits on one laptop or across an entire company network.
The disputed activity, the period, the people, the systems and the readers of the report, agreed with counsel before anything is collected.
Verified forensic images or authorized exports, each with a hash value and a custody record from the first acquisition forward.
File system, operating system, application, account and network records placed on one timeline and tested against every competing explanation.
Observed fact kept apart from interpretation, with the reasoning written down so another qualified examiner can test it and reach the same result.
The first conversation fixes the question the report must answer. From there we list every laptop, server and cloud account that could answer it, along with the people and the dates that matter. That map decides what we collect and what we leave alone.
Scope also sets the cost. A focused plan puts the effort on the devices, accounts and dates that bear on the dispute, which keeps collection and review proportionate while still preserving everything a later challenge would require.
Preserve first and decide the rest later. Call (800) 868-8189 before any device is reassigned, synced or wiped, and we will tell you what to hold today.
Speed matters here. Automatic updates, synchronization and ordinary use rewrite timestamps every hour a machine stays in service. We open a custody record, image the hardware with verified hash values and take authorized exports from Microsoft 365 and Google Workspace, so anyone who later checks the evidence can confirm nothing changed in our hands.
Preservation also reaches the records that expire on their own schedule: cloud audit logs with short retention windows, backups due to rotate and accounts about to be closed. We name those sources on the first call so nothing ages out while the scope is settled.
With the evidence secured, we go past the visible files into unallocated space, deleted documents, USB connection histories, shortcut and jump list records, browser history, application logs and encrypted containers. The decisive record in a high stakes dispute usually sits in data the user tried to erase or never knew existed, and when a commercial tool stalls on a custom file format, we confirm the result by a second method before it reaches a report.
Then we line up events across every device and account in the matter. When a laptop shows a USB drive connected at 11:42 at night, six minutes of activity in the customer contracts folder and a webmail session from the same machine an hour later, we test whether independent records show those contracts being copied or sent, and we separate what the system did automatically from what a person did deliberately.
Every artifact was created by something: a user, a background process, a sync client, automated software or someone sharing a password. We test each explanation against the record and name the ones that survive, so you know the strength of the account before the other side tests it.
The last stage turns the findings into a written report, a visual timeline and exhibits built for a courtroom or a boardroom. We work alongside retained counsel and hand off to eDiscovery collection and processing when document volumes are large. Each finding identifies its source record, why it matters to the dispute and how it fits the rest of the evidence, with the reasoning written down so your trial team can prepare for any challenge to the method.
When the matter goes to deposition or trial, the examiner who did the work testifies to it. In COMLAB v. Kal Tire, Joseph Caruso's analysis of manipulated document metadata led a federal court to find fabrication and spoliation by clear and convincing evidence, and the court described his testimony as reasonable, logical, and ultimately highly credible.
If this matches the evidence in your case, tell us what you have and we will map the next steps on the first call.
Evidence commonly examined
We image desktops, laptops, servers, external drives and USB media so the original never changes. Operating system and application artifacts show what was opened, copied, printed or deleted, and email, cloud storage and identity logs confirm or contradict what the local machine shows. Backups, snapshots and volume shadow copies often hold earlier versions of the disputed file, and custody records tie every source to its owner.
What you can expect
You receive an acquisition record documenting each source, its condition and its hash value, artifact schedules and a timeline that tie every relevant action to the underlying record, and a report that states each finding and its basis in plain language a court can follow. The examiner who wrote it supports it by declaration, in deposition and at trial.
Tell us the question, the sources and the deadline. A senior examiner will walk you through the preservation plan, the examination and the report your matter needs, and will check conflicts and relevant experience before anything is engaged. The initial consultation is free.
See how our database and computer forensics work supported the plaintiffs in Rogers v. BNSF Railway, the first BIPA class action to reach a jury trial, and meet the examiners behind it.
Get a Free ConsultationOur documentation records methods, tool versions, dates, integrity values and every acquisition exception, including any change to a source. Each finding links to its artifact and distinguishes an account or device event from a personal action that other records corroborate. Testimony and any additional collection are set out in the engagement scope.
Describe the devices and the deadline and the first call sets the plan.
Joseph Caruso founded Global Digital Forensics and serves as its CEO and CTO. His technology career began in 1980 in software development, mainframe databases and real time transaction systems, he holds the CISSP and is a Certified Forensic Examiner, and his consulting expert work includes Motorola Mobility v. Microsoft and Apple v. Samsung.
Robert Knudsen brings 18 years of forensic experience and hundreds of computer and mobile device examinations supporting federal and state court matters, after twenty years with the New York City Police Department; he holds the CISSP, the Certified Computer Examiner credential from ISFCE and the EC-Council CHFI. Veronica Perez, a Senior Computer Forensic Specialist listed as an EnCase Certified Examiner (EnCE) in 2009, has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago. Read the full examiner profiles and ask for a current CV on your first call.
Frequently asked
Before anyone reassigns it, wipes it or lets IT run its standard cleanup. Routine activity overwrites the records that answer the question, and a few days can separate a clear timeline from an argument about what might have been there. Call us first and we will plan preservation around your operations.
Yes. We review how it was collected and what it can support. If the collection left gaps, we say so and identify the other sources that can close them before anyone relies on the result.
Yes. A focused scope puts the work on the devices, accounts and dates that bear on the question, which keeps collection and review costs proportionate while preserving what a later challenge would need.
No. Tell us what happened, what is disputed and when you need an answer. Translating that into the right technical questions, sources and methods is the examiner's job, and the initial consultation is free.
The question, the people and devices involved, the relevant dates and your deadline. Keep originals intact. We will arrange a secure transfer method and a custody record before anything moves.
A statement of the question and the sources examined, the acquisition and custody record, a timeline in which every entry cites its source record, and the findings with their supporting artifacts, written so counsel, executives and a court can follow the reasoning.
Yes. Ask for a current CV, relevant case experience and availability. Our examiners' credentials, including the CISSP, EnCE, CCE and CHFI, and their federal and state court experience are listed on the About page, and we clear conflicts and expert disclosure requirements before engagement.
Free consultation
On the first call a senior examiner hears the dispute, identifies the computers and accounts that matter, tells you what to preserve today and outlines the examination, the timeline and the report. Conflicts and relevant experience are checked before engagement.
Since 1992, with a 24/7 hotline and examiners who have testified in federal and state courts.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .