Computer and Mobile Forensics Expert
B.S. in Information Technology, M.S. in Computer Science, M.S. in Information Security: Digital Forensics. Multiple certifications including EnCase Certified Examiner (EnCE), Magnet Certified Forensic Examiner: AXIOM (MCFE), and CISSP.
• Computer Forensic Examinations (Windows & Mac)
• Mobile Device Examinations (iOS & Android)
• Review and Analysis of Expert Witness Findings/Reports
• Planning for cross-examination of opposing experts
• Forensic imaging and preservation of evidence
• Deleted file recovery
• Deleted record recovery
• Internet history/activity analysis (including social media)
• Analysis of network and server logs
• Analysis of database records
• Computer activity analysis
• E-discovery – Gmail, Microsoft Exchange, text messages
Primary Tools: Magnet AXIOM, GetData Forensic Explorer
Litigation Support Services
Willing to work as a testifying or non-testifying expert for the plaintiff/prosecution or defense. Able to analyze expert reports/findings, conduct examinations to provide a second opinion, assist with wording of discovery documents, and/or recommend lines of questioning for opposing experts.
Areas of Expertise
Trace Digital Forensics, LLC in the Social NetworksFacebook LinkedIn
Trace Digital Forensics, LLC (September 2015 – Present)
Director of IT Security
Kern Community College District (June 2016 – Present)
Director of Technology Services
Madera Unified School District (September 2013 – June 2016)
Manager, Online Education Systems
Merced College (September 2006 – September 2013)
Network Test Engineer
Front Porch, Sonora, CA (March 2005 - September 2006)
Merced College - Merced, CA (September 2002 - March 2005)
EnCase Certified Examiner (EnCE), #15-0815-6750
Magnet Certified Forensics Examiner (MCFE) – AXIOM
GIAC Security Leadership (GSLC)
Certified Information Systems Security Professional (CISSP), #441200
Certified Mobilyze Operator (CMO)
Legal Experience & Services
January 2016 - I submitted a report in an embezzlement case. I was able to use database records to show that a specific workstation was used to modify charges and payments associated with the theft. The defendant pleaded guilty.
March of 2018 - I consulted for the defense on a felony bench trial for distribution of child pornography and the information I provided was used in the cross-examination of the prosecution's expert. The defendant was acquitted.
April 2018 - I consulted for the defense on a drug-related case. The case was settled.
June 2019 - I am currently working on a felony case for possession and distribution of child pornography.
National Association of Criminal Defense Lawyers (Investigator)
California Attorneys for Criminal Justice (Expert)
International Information System Security Certification Consortium - (ISC)²
Seminars & Training
• Security Leadership Essentials - SANS (2019)
• Security Operations on AWS - Amazon (2018)
• Magnet AXIOM Examination - Magnet Forensics (2017)
• First Responder Workshop – SecureWorks (2017)
• Practical Introduction to Cyber Security Risk Management – SANS (2016)
• Windows Security and Forensics – Microsoft Virtual Academy (2016)
• Advanced Internet Examinations – Guidance Software (2016)
• EnCase Examinations of the Macintosh Operating Systems - Guidance Software (2015)
• EnCase Certified Examiner Prep Course, Guidance Software (2015)
• Forensics II, Guidance Software (2015)
• Forensics I, Guidance Software (2015)
• Certified Ethical Hacker, Secure Ninja (2014)
• CISSP Review, Fishnet Security (2012)
• Microsoft SQL Server 2008, Webucator (2009)
• Introduction to Microsoft T-SQL, Webucator (2009)
• Ultimate Hacking Expert: Black Hat (2006)
• Threat Modeling and ATT&CK, Chief Information Systems Officers Association - March 2019
• Passwords and Threat Modeling, CCC Information Security Workshop – July 2017
• Digital Forensics Procedures and Imaging, CCC Information Security Workshop – January 2017
• Detecting and Investigating Inappropriate Behavior on the Network, CETPA 2015
• Staying Safe Online, Summer Tech 2015
• Preserving Digital Evidence. Res Ipsa Loquitur (Kern County Bar), October 2017.
• Defeating Compiler-Level Buffer Overflow Protection. ;login:, 30(3): 59-71, 2005 Jun.
• Finding Malware on Compromised Windows Machines. ;login:, 30(2): 6-10, 2005 Apr.
• The Importance of Securing Workstations. ;login:, 30(1): 23-26, 2005 Feb.
• Improving Security with Homebrew System Modifications. ;login:, 29(6): 26-32, 2004 Dec.
• Password Protection for Modern Operating Systems. ;login:, 29(3): 23-33, 2004 Jun.
• Avoiding Buffer Overflows and Related Problems. ;login:, 29(1): 14-21, 2004 Feb.
Available on request
Master of Science in Computer Science, Capitol Technology University
Master of Science in Information Assurance & Security, Capella University
Specialization: Digital Forensics
Bachelor of Science in Information Technology, Capella University
Specialization: Information Assurance and Security
Associate of Arts in General Studies, Merced College
Articles Published by Trace Digital Forensics, LLC
What Is an IP Address?
Cases such as copyright violations, computer hacking, and distribution of child pornography often involve using an individual's IP address to identify them. But, what is an IP address and how reliable are they at identifying individuals?Read Article
Understanding Deleted Files and What They Mean
Attorneys who need to read and understand reports by computer forensics professionals and/or who need to present recovered files as evidence should understand how files are stored on computers and mobile devices, what happens when they are deleted, how they can be recovered, and know the limits on file recovery.Read Article