Servers, Workstations, Identities and the Logs That Connect Them

IT Forensics Across Every Server, Account and Log

An incident or a dispute rarely lives on one machine. It runs across workstations, servers, directory accounts, email tenants, cloud consoles and databases, each with its own clock and its own gaps. Global Digital Forensics collects those records, reconciles the clocks and reconstructs what happened in an order a court can follow, with every step documented.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

What Each System Record Actually Proves

IT forensics is the examination of business infrastructure: the servers, endpoints, identity systems, email platforms, cloud services and databases an organization runs on, examined to establish who did what, when and from where. Legal and security teams bring it to us for trade secret and departure disputes, internal fraud, unauthorized access, contract and vendor disputes and incidents headed for a regulator or a jury. Businesses bring it to us when they need to know what happened before they decide what to tell anyone.

The discipline is in knowing what each record can bear. A Windows ShimCache entry shows that a program was present or was checked for compatibility; proving it ran at a particular time takes corroborating process, Prefetch, event or application records, read for the specific Windows version in front of us. A cloud storage inventory describes the objects that exist, and whether anyone accessed or copied them depends on the data event logging that was enabled and retained. Before we draw a conclusion we check the tenant edition, audit settings, roles and retention against AWS CloudTrail data events and Microsoft Purview audit log activities.

Database conclusions rest on the audit and change sources that were configured and retained, so we document each source period, its time basis and its exceptions. Our process follows NIST SP 800-86, and every finding shows the record behind it before the other side asks.

The logs with the shortest retention are the ones a dispute needs most, so if a matter is forming now, call (800) 868-8189 and we will tell you which records to hold before anything else.

Methodology

How the IT Forensic Examination Works

Define the systems and the disputed activity

We define the activity, the period, the people, the systems and the readers of the report before anything is collected, so the examination serves the decision your team has to make.
Preserve the IT records before retention removes them

We document source condition and acquire the evidence with hash verification and custody records, giving priority to the logs with the shortest retention, because an enterprise keeps writing while a dispute is being argued.
Examine and correlate system activity

We correlate file system, operating system, application, identity and network artifacts on one normalized timeline, so records from different systems can support or challenge the proposed account of events.
Explain the connected findings

We keep observed facts apart from interpretation and hand over the workpapers another qualified examiner would need to check the result.

Evidence commonly examined

IT Evidence We Examine

Computers, drives and removable media provide the physical sources, and forensic images and verified working copies preserve the acquisition record while the examination proceeds. Operating system and application artifacts give the recorded context for files, processes and user activity, while account, network and cloud records connect identities and communications across systems. Backups, snapshots and recovery media supply earlier system states for comparison, and custodian and custody records establish who owned each source and how it was handled.

What you can expect

Ask an examiner how this applies to your matter; the first consultation is free.

Your Findings, Timeline and Forensic Report

You receive an acquisition and source condition record that documents what was obtained and how it was preserved, artifact schedules and event timelines that organize the technical evidence into a reviewable chronology, findings tied to their supporting sources and, as the engagement requires, a report, declaration and testimony support.

When the question is a single workstation or drive rather than the whole infrastructure, our computer forensics practice handles it with the same methods and the same examiners.

A Senior Examiner for the Whole Infrastructure

Bring the disputed activity, the systems involved and the deadline to a free initial consultation. A senior examiner will cover source preservation, relevant experience, potential conflicts and the examination or expert scope your matter requires before anything is engaged.

Robert Knudsen, a CISSP and Certified Computer Examiner, brings 18 years of forensic experience and hundreds of computer and device examinations supporting federal and state court matters, and our founder Joseph Caruso began his career on mainframe databases and real time transaction systems. Read how that database and computer forensics work supported counsel in Rogers v. BNSF Railway, and review the forensic team and their qualifications.

Get a Free Consultation

Technical methods and scope

Connect Evidence Across Enterprise Systems

One enterprise matter can involve workstations, servers, email, cloud storage, collaboration platforms, access control and application databases spread across locations, cloud regions and business units, each with its own retention window and administrative boundary. We map those boundaries first and use network traffic where communications, remote access or data movement need to be tied to endpoint evidence.

Windows endpoint and server examinations draw on complementary artifact sources, and we select the records that can answer the actual question and interpret them for the version of Windows involved.

Registry hives (NTUSER.DAT, SYSTEM, SOFTWARE, SECURITY and SAM) give account and configuration context, USB connections, network drive mappings, persistence and traces of program and user activity, and correlation establishes what each entry supports.

Security, System and Application event logs, PowerShell operational logs, WMI activity, Task Scheduler and application sources record logons, privilege use, process creation, account changes and policy events, where they were enabled and retained.

Prefetch, process events, Amcache and ShimCache are interpreted for the specific operating system version. We separate the records that support execution from those that show presence or compatibility and give the basis for every timing conclusion.

LNK files, Jump Lists and ShellBags retain context about files, folders and removable media, including references to items since deleted. We evaluate what each shell artifact actually records before we describe an access event.

The NTFS Master File Table supplies file metadata and timestamps, and the $LogFile and $UsnJrnl records retain file operations, including evidence about deleted items.

Hibernation and page files can retain process memory, connection details, keys and other activity absent from persistent logs. We assess the residual material actually present and relate it to the timeline.

For Linux and Unix systems we examine retained shell history, system logs, cron settings, SSH authorized keys, PAM and sudo records, account and group files and kernel audit records, and web, database and application servers add access and error logs, application logs and package histories.

Active Directory analysis examines retained account and group changes, privileges, Kerberos activity, LDAP reconnaissance indicators and evidence relevant to forged ticket abuse. Where available, directory replication metadata adds attribute change context alongside the event logs so identity changes can be compared across the retained sources.

For Microsoft email we confirm the supported Purview eDiscovery, audit and Microsoft Graph collection paths for the tenant, role and data type, and other mail platforms receive their own export and log review. Each collection records the workload, query, period and missing source exceptions so the report describes actual coverage.

Server and storage work covers physical and virtual servers, NAS and SAN systems, operating system artifacts, application logs, backup catalogs and storage audit records. In VMware vSphere and Microsoft Hyper V environments, snapshots, vCenter events and host logs help reconstruct activity in the virtual infrastructure.

For SQL Server, Oracle, MySQL, PostgreSQL and MongoDB we confirm the release, the access granted and the retained transaction, audit, backup or replication sources. Transaction history and query access history answer different questions, so conclusions identify the configured coverage and period. Our founder’s background in mainframe databases and real time transaction systems informs how we read these records.

We examine ERP, CRM, document management, HR and financial application records, including SAP, Oracle and Salesforce applications where in scope, because their recorded access, modifications and administration connect system activity to the business records at issue.

How GDF Preserves and Examines IT Evidence

We document every material acquisition and examination action so another qualified examiner can review the method and the result. The plan identifies the applicable references, including NIST forensic process guidance, SWGDE practice and the ISO standard for evidence identification, collection, acquisition and preservation, and explains how each applies to the assignment.

Physical acquisition begins with source condition and write protection, documenting any necessary change or limit. We record the image format and the cryptographic integrity values. When volatile evidence or operational continuity calls for live collection, we capture memory, active connections and processes before disk acquisition where appropriate, and custody records follow each source and transfer through return or approved disposition.

Cloud collection uses the supported methods for the source, such as Microsoft 365 eDiscovery, AWS CloudTrail exports and S3 inventory, Azure activity and monitor records and Google Vault exports. We identify the account, method, scope, dates, tool or API version, exceptions and available integrity values, and we keep inventories, which describe objects, apart from event sources, which describe activity.

We prioritize the artifacts that can answer the agreed questions and tie each finding to its source, path or registry key, time basis and examination note. Where supported, we document indicators of timestamp manipulation, event log clearing, shell history deletion, secure deletion tools and log modification, read in context with the other records.

We define the relevant artifacts and privilege handling with counsel before the examination, then provide interim findings so the team can direct justified scope changes as the evidence develops. Final reporting carries the technical detail needed for expert disclosure and a summary for client briefing or settlement discussions.

When expert support is part of the engagement, the reporting and workpapers support deposition, motion practice or trial testimony as the case requires, explaining artifact behavior in plain language while retaining the detail an independent technical review needs.

Call (800) 868-8189 to talk it through with an examiner, or send the details.

Frequently asked

Before an IT Forensic Examination Begins

What should we define before an IT forensic examination?

Map the affected systems, the administrator and user activity in question and the logs you know exist to the events the examination must explain. If you are not sure which systems matter, tell us what happened and we build the inventory with you.

What should we provide for the first discussion?

The question, the sources, the dates and your deadline. Keep the originals intact and ask IT to hold every system as it is. We arrange a secure transfer method and a custody record before anything moves.

Can the examination focus on a specific issue?

Yes. The agreed scope identifies the authorized data, the systems, the methods and the deliverables, which keeps the cost in proportion to the dispute while preserving what a later challenge would require.

Can we review the qualifications of the proposed examiner?

Yes. Ask for a current CV, relevant experience and availability. The credentials and the federal and state court experience of our examiners are listed on the About page, and potential conflicts and expert disclosure requirements are addressed before engagement.

Free consultation

Hold the Records That Rotate First

On the first call a senior examiner reviews the system inventory, the period and your deadline, names the logs that rotate first and outlines the authorized collection, the examination and the report.

Global Digital Forensics has operated since 1992, and rapid response specialists answer the hotline around the clock.

GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.