Computer and Digital Forensics

Find the activity recorded in files, logs and deleted data

When a matter turns on who opened a file, where the information went, whether a message is genuine, or what someone did on a laptop the night before they resigned, a keyword search will not settle it. The evidence is in the records the systems kept without anyone asking them to. A digital forensics examination by GDF preserves those records, connects them across devices and accounts, and explains what they show in language counsel, executives and decision makers can use.

Global Digital Forensics has been doing this work since 1992. The expert practice includes federal court and ITC matters, and the client list runs from Fortune 1000 companies to AmLaw 100 firms. The approach has not changed much in that time: start with a specific question, then find the sources capable of answering it. One laptop or records spread across an entire business, the method is the same.

One question, then the sources that can answer it

Did company information leave before the employee gave notice? Does this file actually predate the event it supposedly documents? Which records explain a transaction nobody will take responsibility for? A sharp question tells us which devices, accounts, people and date ranges are worth the effort, and which are not.

Computer and digital forensics is the documented preservation and analysis of digital records. Depending on the source and the issue, we may examine the device itself, a verified forensic copy, or related records from email, cloud services and business systems. We choose the method for the source in front of us rather than running one tool against every matter and hoping.

Connecting traces across sources

Say the laptop shows a USB drive was connected at 11:42 p.m. The file system shows a folder of customer contracts was accessed in the following six minutes. Browser history shows a visit to a webmail service from the same machine an hour later. None of these alone proves that the contracts were copied or sent. Together they form a sequence, and GDF's job is to say how strongly that sequence supports the account of events one side is proposing.

An artifact is a technical trace left by a system or application. Some record a deliberate human action. Others reflect background processing, synchronization or a later change that had nothing to do with the user. Treating every artifact as evidence of intent is the most common error in the reports we are asked to review.

A file appearing on a computer does not establish that the user downloaded it on purpose. Sync clients, automated software and shared credentials all put files on machines. A competent examination looks for the independent records that explain how the file arrived and what happened to it afterward, and reports the alternative explanations it could not rule out.

Preserve records before routine activity changes them

Reassigning the departed employee's laptop, wiping their phone, deleting the account, or letting IT run its standard cleanup script can destroy the records that would have answered the question. Contact GDF before those steps when a dispute is likely. We can put together a preservation plan that respects authorized access, the condition of the source and the fact that your business still has to operate tomorrow.

Deleted content may or may not come back. Storage technology, encryption, reuse of the space and retention settings all decide that, and we assess before we promise anything. Even when the content itself is gone, surrounding records often establish the filename, an earlier version, or the fact that the file existed and was acted on. We explain what the source can support and what it cannot.

Reports written for the people who have to rely on them

Deliverables can include a concise findings report, a timeline in which every entry links to its source record, relevant native files and exhibits. Where the matter calls for it, the examiner explains the methods and the conclusions, with the evidence behind each, in reports and in testimony.

Finding an interesting record is the easy part. Showing where it came from, its relevance to the matter and how it fits with everything else in the evidence is what keeps it standing under cross-examination, and every GDF report is written with that examination in mind.

Put GDF on the evidence early

Put GDF on the evidence early. Call 1-800-868-8189 for a free initial consultation, or contact us before devices are reassigned or records expire. Tell us the question, the likely sources, your deadline and where the evidence sits right now. We can discuss preservation, secure collection, computer and digital forensics analysis, reports, exhibits and expert support.

Put GDF on the evidence early

Related services and resources: computer drive forensics, mobile device forensics, email Microsoft 365 forensics, computer forensics expert witness, approved case studies and team.