Shopping Cart
Your Cart is Empty
There was an error with PayPalClick here to try again
CelebrateThank you for your business!You should be receiving an order confirmation from Paypal shortly.Exit Shopping Cart

Through his firm PenrodEllis Forensic Data Discovery (FDD), David J. Penrod can address any issue involving computer-generated information, from the mundane to the most complex. Whether one's case is civil, criminal, or even internal, if it includes Electronically Stored Information (ESI) and you need it analyzed, then Mr. Penrod can help. Using his proprietary digital forensics taxonomy, Mr. Penrod can forensically recover & analyze more computer evidence than any other analyst, as well as explain its meaning & import in a language anyone can understand. His analysis of digital evidence is based on a careful, painstaking review of file content (data), file properties (system & application metadata), & user activity/file tracking records (external metadata). It also includes the salvaging of both intact & partially overwritten latent data. Mr. Penrod will also prepare expert reports and testify under oath at depositions, hearings and trial.

PenrodEllis FDD of Denver, Colorado conducts forensic computer examinations to recover incriminating, exculpatory and mitigating computer evidence. Computer investigations require considerable expertise in hardware and software technologies, written and oral communications, and rules of evidence. PenrodEllis forensic compouter examiners are certified experts and possess all the requisite skills to conduct forensic computer investigations. We have been conducting computer examinations since 1997.


A digital forensic examination can recover evidence of:

  • Employer or employee misconduct
  • Misuse or mishandling of company assets
  • Larceny, embezzlement, misappropriation & frauds
  • Spousal misconduct & tracking
  • Cyber stalking & harassment

A forensic computer investigation can establish if a person may or may not have:

  • Stolen confidential or proprietary files & documents (trade secrets, software piracy, intellectual property, copyright infringement, etc.)
  • Possessed and/or distributed child pornography & other contraband images
  • Sent harassing or threatening messages via email, chat, or phone text
  • Installed & exploited malicious software (malware) on a computer
  • Remotely accessed & controlled one or more computers

A computer forensic examination can also recover:

  • Deleted files & folders
  • Passwords for encrypted drives & files


A computer forensic analysis can recover or refute evidence of:

  • Attaching peripheral/removable storage drives to computers & transferring ESI
  • Copying files to a personal USB storage drive; emailing files to a personal online mailbox (webmail account); or transferring files to an online storage repository (such as Dropbox, Google Drive, & other cloud storage services)
  • Printing documents & images
  • Deleting files; permanently erasing files; wiping (overwriting) empty/free space on storage drive
  • Downloading, accessing, viewing, changing, and/or sharing files
  • Using or logging on to a computer by a particular person on a specific date & time
  • Accessing restricted files, network locations, or Internet websites
  • Communicating online with certain parties

A forensic examination of computer evidence can authenticate:

  • Documents & spreadsheets
  • Financial ledgers
  • Email messages
  • Chat & text communications

Electronic discovery (e-discovery) and digital forensics are not the same thing. e-discovery is an automated process that recovers active files only. Collected ESI is not forensically examined.

Digital forensic examinations, on the other hand, involve the processing, parsing, and searching of both active and latent ESI (intact and partially intact deleted files) and the personal analysis of potential evidence recovered during that search. Experience is the cornerstone of that analysis. Mr. Penrod follows an exclusive set of taxonomies, which are based on 22 years experience in digital forensics, to turn digital information into digital evidence.  

Internal and external hard disk drives are the single largest source of ESI in any matter involving e-discovery, computer forensics and incident response.
Tablet Computer (2)

The terms computer forensics, computer forensic examination, & forensic computer examination have been in use for a relatively short time but have already become obsolete. Digital forensics & digital forensic examination better reflect the range & variety of commonly used single- & multi-purpose computing appliances that can be examined today, such as the ubiquitous smartphone. Other appliances that are part of our every day lives include tablet computers & e-book readers; Internet routers & network modems; exercise & fitness monitors; digital cameras; & streaming video devices. 

PenrodEllis can forensically examine & recover electronic evidence from all these devices. That's because they contain one or more storage components on which ESI is recorded. The computer or appliance records ESI as a series of positive and negative electromagnetic impulses. Dedicated software interprets these impulses as 1's and 0's. This binary computer code is not much different in concept than the Morse Code used in 19th Century telegraph networks to transmit and record text messages. Morse Code consisted of a series of short and long electrical impulses to represent letters and numbers. Telegraph operators recorded these impulses as dots and dashes and then interpreted them as words. 

Internet-Network Router

PenrodEllis Forensic Data Discovery

200 South Wilcox Street, Suite 327

Castle Rock, Colorado 80104

(303) 945-6006