Shopping Cart
Your Cart is Empty
There was an error with PayPalClick here to try again
CelebrateThank you for your business!You should be receiving an order confirmation from Paypal shortly.Exit Shopping Cart

Efficient and effective Electronic Discovery & Digital Forensics begins with the preservation of Electronically Stored Information (ESI). For both large & small businesses, preserving ESI should be a routine, prophylactic action conducted prior to litigation as part of an information management plan. Unfortunately, preservation is most often employed on an irregular basis in response to discovery requests during civil litigation. As a result, critical metadata (the properties & attributes of a file) is often lost - most often due to changes in the status or condition of a file itself.

In criminal matters, preservation of digital evidence is the responsibility of law enforcement. Mr. Penrod most often conducts criminal defense examinations at law enforcement facilities. When contraband images are not part of the evidence, law enforcement will normally produce copies of the digital evidence in discovery to Mr. Penrod for examination at his lab.

Regardless of one's situation, from the initial design of a plan to preparing for trial, PenrodEllis FDD can help.

The certified computer examiners at PenrodEllis FDD of Denver, Colorado are experts in the forensic collection of ESI from computers, mobile phones and other electronic data storage devices. We preserve and safeguard the integrity of electronically stored information. Authenticated forensic bit-stream images are the basis for e discovery as well as forensic computer examinations and network security investigations. It is from forensic images that computer evidence is recovered.


PenrodEllis FDD can extract mathematically authenticated forensic images from the digital devices listed below. For more information about them, click HERE.

Computers, such as network servers, client workstations, & personal desktop/laptop computers

Storage Devices, such as hard-disk & solid-state drives, removable USB keys & flash cards, portable & desktop USB drives, & network storage arrays

Mobile Devices, such as smartphones, mobile phones, tablet computers, & e-book readers

Network Devices, such as Internet modems, unified security gateways, network routers, & WiFi access points

Multimedia Devices, including digital cameras, video recorders, & music players

Television Appliances, such as cable & satellite DVRs, & streaming video players


PenrodEllis FDD can examine the following types of Electronically Stored Information (ESI). Click HERE for more information. 

File systems, such as FAT32, NTFS, HFS+, APFS, & HPFS

Operating systems, such as Windows, MacOS, Linux, Android, & iOS

Active & Latent ESI, including file content (data) & properties (metadata), as well as intact & partially overwritten deleted, temporary & discarded files

Office Documents, such as word-processing files, spreadsheets, presentations, & publications

Electronic Communications, such as email, chat, & text messages

Internet Access Records, such as web browser databases & P2P client files

Logs, which include system event, user activity, file usage, & audit trail records

PenrodEllis FDD of Denver, Colorado forensically recovers ESI in e-discovery and digital forensic cases from  the forensic image and not the originating source of the ESI.

Forensic examiners preserve ESI by extracting authenticated forensic bit-stream images from the storage components of computers, appliances, & external drives. Forensic imaging captures all active & latent ESI on storage media. A forensic image (often called a mirror image) preserves that ESI as it existed at the time of its extraction & safeguards its integrity. A mathematically verified forensic image is the foundation that establishes recovered data & metadata as legal evidence. Courts throughout the world accept forensic images as authentic representations of the original ESI on a storage drive, allowing experts to submit evidentiary ESI in hearings and at trial. For this reason, forensic recovery of ESI is only rarely conducted against "live" computer systems and storage devices. The forensic bit-stream image is the only source of computer evidence presented at trial.  

PenrodEllis Forensic Data Discovery

200 South Wilcox Street, Suite 327

Castle Rock, Colorado 80104

(303) 945-6006