We handle digital evidence for civil litigation, employment disputes, internal reviews, insurance claims and incident response. Work can begin in Manhattan, the outer boroughs, Long Island or Westchester and scale across sixteen GDF offices nationwide when custodians and systems are spread out.
Diagram description
Connected stages follow the item through identification, preservation, transfer and receipt. The received item is reconciled with its identifier and integrity digest.
- Identify: Source and item ID; Collection authority.
- Preserve: Acquisition method; Integrity digest.
- Transfer: Sender and recipient; Time and purpose.
- Reconcile: Received item; Digest comparison.
One item. A continuous handling record.
Preserve the Source Before Anyone Interprets It
A finding is only as strong as the preserved source behind it. Examiners identify the device, account, cloud tenant, log source, backup or business application that holds the record, then document acquisition settings, dates, time zones, hash values and every custody transfer. That defensible chain of custody lets another qualified examiner retrace each step.
New York matters bring short return dates, emergency applications, custodians working from apartments and enterprise systems run by third parties. We plan around them with remote collection where it fits, on site imaging where it does not, and laboratory work for damaged or locked media.
Tell Us What the Evidence Needs to Show
Name the devices or accounts involved and the question your matter turns on. A senior examiner will outline a focused examination on a free call.
Findings That Separate Fact From Inference
The goal is to answer the disputed question, not to deliver a pile of artifacts. That can mean correlating file system records, email headers, cloud audit logs, mobile app databases, authentication events, USB history and deletion activity. Every finding is labeled as observed fact, technical inference or information supplied by others, so counsel knows exactly how much weight it carries.
Depending on the scope, you receive a preservation memorandum, a chronology, a technical report, declaration support, demonstratives or expert testimony, each tied to the sources, methods and competing explanations behind it.
Typical work includes forensic acquisition of computers, phones, email, cloud accounts and removable media; deleted file, timeline, metadata and provenance analysis; coordination with counsel and eDiscovery teams; and independent replication or rebuttal of another examiner's work.
A Working Record Another Expert Can Retrace
Every conclusion traces back to a hash, a timestamp and a method another examiner can rerun. We keep the authorization, custody forms, acquisition logs, tool versions, time zone decisions, queries and validation results behind each finding, so a challenge to the report becomes a walk through the record.
The depth of that record scales with the dispute, but a reviewer can always see what was examined, what was excluded, which method produced each result, and which judgments belonged to the examiner rather than the software.
Corroboration Across Devices, Cloud and Business Records
The most useful fact may not be on the device named in the complaint. A file copy question can require endpoint artifacts, Microsoft 365 events, a cloud drive revision history, USB records, source control logs, and business access data. An authenticity question can require the native message, account records, a sender device, and the receiving system rather than a printed copy.
GDF maps those sources first. Agreement among independent records can strengthen a conclusion. Conflicts can reveal time zone errors, platform processing, shared credentials, incomplete collection, or another explanation that must be addressed before reporting.
Agree on the Question and the Deliverable
Start with the disputed event, the available sources and the next deadline. We agree on the preservation steps, the examination scope and exactly what your team will receive, and we document every technical finding the matter will rely on.
Set the question, the sources and the deadline with a senior examiner.