Evidence Solutions is a leading expert witness firm.

• Computer Forensics
• Mobile Device Forensics
• eDiscovery
• Digital Investigations
• Complex Networking & Communications
• Law Enforcement
• Digital Media Data Interpretation
• Metadata
• Security Threats
• Password Recovery / Cracking
• Electronic Medical Records
• Data Recovery
• Peer-to-Peer File-Sharing Applications
• Web Browsers
• Social Media
• Hard Drives

• 30+ years of leadership, law enforcement, digital investigation, and e-discovery experience.
• Conducted over 3000 detailed and complex forensic examinations of computers, cellular devices, and related equipment.
• Experienced in the use of Encase, FTK, Nuix, Axiom, Cellebrite, and other forensic and eDiscovery platforms.
• Experience in ASCLD certified laboratory settings.
• Served as a technical advisor for matters relating to identification, preservation, and collection of electronic evidence.
• Developed software and tool validation test plans.
• Collaborated with federal, state, and local representatives regarding common challenges and the research of digital forensic examination products.
• Developed and provided in-depth and agency specific training for the establishment and management of multi-disciplinary investigative teams.
• Developed training for agencies and organizations regarding technology facilitated child sexual assault, technology management for parents and educators, and the investigation of crimes against persons.

• Access Data Examiner
• Mobilyze Operator
• Crisis/Hostage Negotiator (Previous)
• Ethics Training Facilitator (Previous)
• WMD/CBRNE Technician (Previous)

• Conducted investigations into difficult, complex, technical, and sensitive matters involving computer and computerized evidence which may be national in scope. These investigations included complex networking and communications problems and legal issues, which required law enforcement and civilian cooperation nationwide.
• Conducted forensic examinations of digital evidence collected on the battlefield in two theaters of combat operation in support of the Global War Against terrorism.
• Conducted highly specialized visual and/or computer based examinations of computers, related peripheral equipment and other automation/data storage devices; such as cell-phones, personal data assistants; as well as various forms of computer media. 100% accountability and sound forensic processing of physical and automated information evidence submitted for examination from supported USACIDC offices, state and local law enforcement jurisdictions as well as the Southern Virginia Internet Crimes Against Children Taskforce (SOVA ICAC).
• Conducted and supervised all felony-level criminal investigations for the Fort Eustis area of responsibility (South EastVirginia).

• Qualified as an expert in Digital Forensics by the Department of Defense (Army). Providing routine testimony for criminal cases in Texas, Virginia and the Federal Republic of Germany.
• Qualified as an expert in Digital Forensics in United States Federal Courts (Eastern District of Virginia).

• Accounting & Medical Billing Systems Forensics
• Accounting System Forensics
• Black Box, ECM, ECU, EDR, DDEC, Download & Analysis
• Black Box/Event Data Recorder/EDR, Forensics
• Cell Phone Carrier Forensics
• Cell Phone Forensics & Mobile Device Forensics
• Computer Forensics
• Data Fabrication Forensics
• Digital Camera Forensics / Digital Photo Forensics
• Digital Copier Forensics
• Digital Photo Forensics
• Document & Spreadsheet Forensics
• Electronic Device Forensics
• Electronic Logging Device / ELD Forensics
• Electronic Medical Record (EMR) Forensics / Electronic Health Record (EHR) Forensics.
• Email System Forensics
• Evidence Solutions Expert Services
• Event Data Recorder / EDR Forensics
• File Date Forensics
• Portable Data Format / PDF Document Forensics
• Printer & Fax Machine Forensics

Scott’s extensive knowledge draws clients to him from all over the United States as well as Internationally for consulting and expert witness services in the field of Computer, Technology & Digital Forensics. His extensive and diverse experience allows him to be an expert in many facets of computer & digital technology. He is a sought after speaker & educator and travels the world presenting to local, regional, national and International organizations.

Qualified as an Expert in Digital Evidence more than fifty times:

• Civil & Criminal
• Special Master
• Plaintiff and Defense
• Insurance, Corporate, Family Law
• Justice, Superior & District Courts as well as Arbitration Hearing

Civil Defendants - 30% | Civil Plaintiffs - 50% | Criminal Defendants - 20%

• Facebook Forensics / Facebook as Evidence: In a recent trucking case I discovered that the driver was a regular poster on Facebook. This particular Commercial Driver’s License (CDL) holder posted photos of his driving. Because he had his location has part of his post, I was able to determine his location and the time he started his trip. I calculated the time it would take this semi driver to drive from where he started his trip to the site of the crash. The time of the crash was determined by the law enforcement officer who wrote the Texas Peace Officer’s Crash report. The estimated time to make this trip of over 1650 miles was over 25 hours of driving. Using the time difference between the Facebook posts and the time of the crash I determined that the driver made this trip in under 31 hours. This CDL holder’s driver logs reflected a completely different story which was used against him and helped paint a picture that this driver had not only broken the rules about rest breaks while operating a Commercial Motor Vehicle (CMV) but also that he was likely fatigued when he ran into stopped traffic in a construction zone where is killed 1 person and injured several others.
• Multiple Cell Phones in a Truck Case: In a Texas Truck wreck case I was hired to examine data from both Call Detail Records (CDRs) received from the cell phone carrier AT&T and the Android Cell Phone for the defendant driver of an 18 wheeler tractor / trailer. The CDRs indicated that the driver was using his cell phone at or about the time of the subject crash to send and receive SMS Text Messages. I flew to East Texas to collect the data from the cell phone. Counsel for both the Plaintiff and the Defense along with the Defendant's own Cell Phone Expert were present. I supervised the Defense Expert doing a couple of standard downloads using Cellebrite. As soon as the data popped up on the screen it was obvious that something was wrong. While it had been represented that the cell phone supplied at this event was the defense counsel preserved cell phone that was in the cab of the tractor, the data on the phone didn't date back to the date of the crash. I then compared the serial number previously supplied in the CDRs with the serial number of the phone and found the discrepancy. The phone that was delivered for inspection was not the phone in use at the time of the crash. I created an affidavit and subsequently testified in an evidentiary hearing which resulted in sanctions against the defendant's and defendant's counsel.
• International Mobile Station Equipment Identity (IMEI): A unique string of numbers that acts as a standardized serial number for a cell phone. This feature was designed to prevent stolen cellular devices from being used on the network, in theory preventing cell phone theft. It also uniquely identifies a cell phone.
• Intellectual Property (IP) / Patent Case: A California company's former employee was accused of stealing his former employer's design for device. In this case, we worked for the defendant former employee accused of stealing Intellectual Property from his employer. The case hinged on several dated items which appeared to all be legitimate on the surface. PDF documents were produced that had dates that predated the employee's departure from the company, thus indicating the design had been done before he resigned. In addition, the PDF document had been attached to emails that had been printed and presented as However as the investigation progressed, the case against the former employee unraveled. The metadata dates embedded into the PDF document were after the departure of the employee from the employer. Upon a deep dive into the email system revealed further abnormalities. There were multiple Internet Domains included in the emails, an old domain and a new domain. The newer domain didn't exist before the departure of the employee. Further, the Forensics performed on the Microsoft Exchange email server, that allegedly sent the emails, was released by Microsoft years after the dates on the original emails. In the end, it was discovered that Employing Company's Owner had fabricated pdf documents and attached them to fabricated emails to falsely accuse the innocent employee of stealing IP from his company.
• Printed Email Forensic Validation: Generally speaking it is not possible to validate emails as being genuine without access to an electronic original. Call our Digital Forensics Experts today if you have a case involving Email.
• Truck tracking and "Hyper Drive": In a Texas Commercial Motor Vehicle and Passenger Car collision case I was able to determine why a truck was moving from one point on the map to another without appearing to use a road way. Electronic Logging Devices* have been required as Logs for Truckers since 2017. These devices track Tractors via GPS and replace Truck Driver paper logs. However, they are not without their faults. In this particular case, the driver wanted to drive more hours than were allowed by the Federal Motor Carrier Safety Regulations (FMCSRs) Hours of Service (HOS). To do so, he unplugged the ELD, and then went on to drive several more hours and hundreds of miles. After he had driven the additional hours and miles, he would plug the ELD back in. The GPS data would show a Hyper Drive "Hop" to location hundreds of miles away. For a while, it was thought that the driver's company was involved. However, at one point in the driver's journey he stopped about a half a mile short of the depot he was visiting and plugged the ELD back in. 
• *Electronic Logging Devices aka ELDs: ELDs are manufactured by many different companies including GeoTab, PeopleNet, Qualcomm / Omnitracs, Teletrac, etc. These devices can be stand-alone devices in the cab of the tractor or they can be an App installed on a smartphone. They are supposed to be connected to the ECM / ECU of the engine and many transmit diagnostic information back to the company headquarters. Company employees can easily find the location of one of their truck assets using a local application or a web browser.
• Dram Shop Case: In Texas I was engaged to examine data from a point of sale system that was installed in a national restaurant chain franchise. Of interest was whether or not a group of individuals, some of whom were underage, had been overserved in this bar. The data, which should have been in the Point of Sale system, had gone missing. In an evidentiary hearing, the attorneys involved, along with my expert testimony were able to show that the data had been spoliated / deliberately deleted. This spoliation, presented in this hearing, led to the magistrate to order Death Penalty Sanctions* against the defendant restaurant and bar. The Defense now had settled the case, which it did in short order. 
  • *Death Penalty Sanctions arise as a result of a party's discovery abuses. A court can strike a party's pleadings for such abuses. The effect is to eliminate any type of defense a particular party would have related to the merits of the underlying claims of the case.
• Electronic Medical Record Case: In New Jersey, I investigated an OBGYN doctor who owned his own practice. This OBGYN also owned a license for an Electronic Medical Record ("EMR") System known as Medisoft. The Medisoft EMR was hosted on Microsoft Windows servers in this doctor's office. In 2014 he neglected to inform his pregnant patient that she should have an amniocentesis performed to screen for developmental abnormalities in her fetus. The patient swore that she hadn't had a visit on the date the doctor said she had been in his office. The baby was born with abnormalities and the mother ultimately sued the physician in 2016. In 2018, the physician added backdated records into the EMR. These EMR Entries included PDF documents that showed the visit by the patient mother. At the same time, the practice owner doctor turned off and erased the EMR system Audit Trail. Later that year I inspected that system and found evidence in the EMR system as well as embedded into the PDF documents attached to the patient's EMR records. The evidence proved that the entries had been fabricated several years after the alleged patient visit.
• Criminal Defense Case: Working with a Criminal Justice Act (CJA) Court Appointed Federal Public defender, I investigated the accusation leveled at an Information Technology services provider. The IT services company had been accused of denying access to a set of computers in a private company by the FBI. The defendant was charged in an indictment with two counts of Extortion Relating to Damage to Protected Computer, in violation of 18 U.S.C. § 1030(a)(7)(c). Ultimately we convinced the court that the investigation was flawed. Some of the initial representations by investigators and prosecutors made to the court were not representative of the truth.

Our founder and expert witness, Scott Greene, educates and inspires through speaking, education, training, and continued legal training engagements.  He speaks on many topics, loves his work, and would enjoy sharing it with you.  Contact Scott!

"I truly enjoy sharing my knowledge" - Scott Greene

• Mobile Devices
• Call Data Records
• Computer Systems
• Databases
• Digital Cameras
• Digital Media
• E-Mail
• Google Data
• GPS Systems
• iCloud Data
• Browsing Activity
• Intrusions
• Password Cracking
• Images & Videos
• Social Media
• Spreadsheets
• Malware Analysis
• Log Analysis

• Advanced Digital Forensics Examiner
• Digital Evidence Acquisition, Preservation, and Analysis
• Expert Witness Analysis, Reports, & Testimony

• CFCE, Certified Forensic Computer Examiner
• Cellebrite Certified Logical Operator
• Cellebrite Certified Physical Analyst
• Magnet Certified Forensic Examiner
• X-Ways and Advanced X-Ways Certificate of Training
• Hawk Analytics’ Cellular Technology, Mapping & Analysis Training

• Qualified as an expert in the field of Digital Forensics Examinations in Alger County, Marquette County, and Delta County. (100% Criminal Proceedings)
• Qualified as an expert in the field of Digital Forensics in Texas

In addition to teaching Cybercrime, digital forensics, and Computer Hacking Forensics Investigator courses at Northern Michigan University, Jeff also regularly speaks and teaches Cybercrime, Digital Forensics, Cyber Security, Cyber etiquette, & Cyber Safety to various organizations. These organizations include:

• Community Schools K-12
• Community Organizations (Service Organizations, Church Groups)
• Industry-Specific Events/Conferences (Financial Institutions, Lawyers, Medical Groups)
• Jeff developed and specifically trained a group of Judges, Magistrates, and Attorneys in digital evidence.
• Jeff taught digital forensics (search and seizure) to the Local Police Academy at Northern Michigan University.
• Chief of Police & Sherriff Groups
• Law Enforcement Agencies