For counsel, internal auditors and enterprise security teams

New York Computer Forensics, eDiscovery and Cybersecurity

A dispute may turn on messages, file activity or records held across several systems. GDF helps New York counsel and businesses preserve and examine digital evidence, understand the findings and arrange expert testimony when needed.

Tell us the decision your team faces, the sources involved and the next deadline. We identify the technical work required, the authority needed to proceed and the records that may change before an engagement begins.

Request a Rapid Case and Scope Assessment

Meet the practitioners and review a public-record example of the work.

New York: (212) 561-5860 24/7 emergency hotline: (800) 868-8189

Manhattan skyline viewed from the Empire State Building in 2018 — Photograph by Carol M. Highsmith, Library of Congress.

Tell Us What You Need

Select the device, account or activity involved in your matter, or speak with an expert to help define the next step.

Computer or company filesPreserve and examine evidence from a computer, drive or company storage.Phone messages or mobile evidenceDiscuss the phone, account ownership and records you need.Email or account activityUnderstand mailbox events, account access and related records.An employee departurePreserve company devices, accounts and relevant file activity.Evidence for litigationPlan preservation, collection and the material counsel needs next.An active cyber incidentDiscuss urgent response, preservation and the systems affected.

Speak with an expert about your matter

Computer Forensics and Expert Witness Testimony

When copying, deletion, authorship or access is disputed, a collection of screenshots rarely explains the complete sequence. GDF examines available computer, mobile, email, cloud and business system records, compares independent artifacts and documents the basis for each finding. Counsel receives an explanation that separates observed activity, supported inference and unresolved questions.

Expert engagements can include reports, rebuttal, declarations, deposition and trial testimony. The examination record identifies the source material, methods, assumptions and limitations that another qualified professional needs to assess the opinion. Counsel directs legal strategy and the court determines admissibility.

Speak With a Computer Forensics Expert About Your Case

Defensible eDiscovery Preservation and Collections

Preservation becomes difficult when relevant records are spread across custodians, shared accounts, cloud platforms and devices that remain in use. GDF helps counsel translate the approved legal scope into a technical collection plan that addresses retention, access, custody and exceptions before review begins.

Remote and on site collections are selected for the source, access conditions and agreed protocol. Collection records and reconciliation show what was expected, what was received and what remains unavailable. Processing and production choices are tied to the specification approved for the matter.

Request an eDiscovery Preservation and Collection Assessment

Enterprise Cybersecurity and Incident Response

During an active incident, containment and evidence preservation compete for the same systems and people. GDF works with authorized IT and security teams to establish the technical chronology, assess available access evidence and document unresolved scope while response and recovery proceed.

For planned assessments, human led penetration testing, vulnerability assessment and application security work examine the paths that could affect important data or operations. Findings describe the tested scope, observed consequence, recommended correction and limits of any retest.

Discuss Engaging an Expert Request an Enterprise Security Scope Assessment

Speak With an Expert About the Evidence Your Case Needs

Bring the deadline, source categories and authority to act. The initial discussion identifies preservation priorities and the specialist your team needs. Keep evidence, credentials and sensitive case material out of the public form.

Request a Rapid Case and Scope Assessment

(212) 561-5860 24/7 emergency hotline: (800) 868-8189

Evidence Methods and Practitioner Experience for Counsel

The retaining team should understand who will perform the work and how the proposed method addresses the disputed issue. Discuss the relevant technology, request the practitioner's current CV and identify the deliverables required for the next stage of the matter.

GDF publishes case studies drawn from public records so counsel can examine the assignment, evidence dispute and later procedural history. Meet the GDF practitioners and discuss experience relevant to your sources. Prior testimony does not determine qualification or admissibility in a different matter.

Preservation Checklists for Litigation Counsel

An employee departure can affect devices, shared files, messaging accounts and retention settings before anyone has defined a collection protocol. Request the Departing Employee ESI Preservation Checklist to organize the systems, custodians and decisions that need attention before offboarding proceeds.

For a broader collection, request the eDiscovery Custody and Collection Readiness Guide. It provides a practical starting record for authority, source coverage, transfer history and unresolved collection exceptions. Counsel determines the preservation obligations and approves the scope.

Read the Employee Departure Guide Read the ESI Preservation Guide

Specialist OT and SCADA Security Support

Matters involving control systems require engineering context, operating authority and attention to safety and availability. GDF's OT, ICS and SCADA security services address asset visibility, segmentation, remote access and incident evidence under operator approved limits. This specialist capability supports the engagement when the evidence or exposure crosses into operational systems.

GDF Software Supporting Collection and Analysis

The service scope determines the tools required. GDF software, including eCloud Discovery, CompleteDiscovery and SourceScan, supports defined collection, analysis and security tasks. Discuss current availability, supported sources and deployment requirements with the technical team before selecting a product for an engagement.

New York, New Jersey and Connecticut Engagement Coordination

GDF coordinates matters involving regional custodians, distributed business systems and counsel handling New York litigation from another state. The New York office is at 1500 Broadway, New York, NY 10036. Visits are by appointment. The engagement plan establishes how remote work, source transfers and any on site collection will be authorized and documented.

Request a Case and Scope Assessment

Describe the technical question and your deadline without uploading evidence or sensitive records. Submitting an inquiry does not create an engagement, preserve a deadline or establish privilege. Scope, authority and secure sharing arrangements are confirmed before technical work begins.

Request a Rapid Case and Scope Assessment (212) 561-5860 24/7 emergency hotline: (800) 868-8189

Illustrations of the Technical Methods

Marble lobby of the Thurgood Marshall United States Courthouse in Manhattan — Photograph by Carol M. Highsmith, Library of Congress.

The opinion follows a technical question through a documented method and tested alternative explanations. View full size diagram (opens in a new tab)
Diagram description
A technical question is connected to a documented method, tests of alternative explanations and the final explanation. Source references support the route to the opinion.
**Question:** Issue to address; Material sources.
**Method:** Repeatable steps; Validation record.
**Test alternatives:** Competing causes; Contrary evidence.
**Explain:** Findings; Source references.
**Diagram focus:** An explainable route from record to opinion

An analysis copy connects preserved sources to a timeline whose events can be traced back to the record.

Source mapping and preservation precede review; reconciliation follows the records through production.

Testing follows connected access paths, then checks the controls that interrupt them.

Controlled conduits connect IT and control zones while the safety function retains a distinct boundary.