Find an Expert Witness

Forensic, General & Medical
Expert Witnesses

Computer and Mobile Forensics Expert Witness

Trace Digital Forensics, LLC

Trace Digital Forensics, LLC

14506 Huckleberry Dr
Bakersfield, California 93314

Phone(209) 769-2370

Website www.tracedf.com

► Contact Trace Digital Forensics, LLC

Expert WitnessForensic ExpertLitigation SupportSpeaker
Steven Alexander has examined computers and mobile devices in response to civil and criminal proceedings, computer misuse investigations, security incidents, and e-discovery requests. He has over twenty years of experience in information technology and has worked as a programmer, network engineer, IT director, and IT security director. He has multiple publications and has presented at several conferences and workshops. He was a charter member of the (California) Central Valley High Technology Crime Investigation Association.

B.S. in Information Technology, M.S. in Computer Science, M.S. in Information Security: Digital Forensics. Multiple certifications including EnCase Certified Examiner (EnCE), Magnet Certified Forensic Examiner: AXIOM (MCFE), and CISSP.

Services

Mr. Alexander offers the following services:

• Computer Forensic Examinations (Windows & Mac)
• Mobile Device Examinations (iOS & Android)
• Review and Analysis of Expert Witness Findings/Reports
• Planning for cross-examination of opposing experts
• Forensic imaging and preservation of evidence
• Deleted file recovery
• Deleted record recovery
• Internet history/activity analysis (including social media)
• Analysis of network and server logs
• Analysis of database records
• Computer activity analysis
• Review of NCMEC CyberTipline Reports
• Review of records/logs related to identification by IP address
• Review of warrant returns from cloud providers (e.g. Google, Discord)
• E-discovery – Gmail, Microsoft Exchange, Office 365, text messages

Primary Tools: Magnet AXIOM, MOBILedit Forensic Express, GetData Forensic Explorer


Litigation Support Services

Willing to work as a testifying or non-testifying expert for the plaintiff/prosecution or the defense. Able to analyze expert reports/findings, conduct examinations to provide a second opinion, assist with wording of discovery documents, and/or recommend lines of questioning for opposing experts.

Areas of Expertise

Additional Expertise:

Computer Misuse

Areas Served

All States

Trace Digital Forensics, LLC in the Social Networks

Facebook PageFacebook LinkedIn PageLinkedIn

Professional Experience

Founder/President
Trace Digital Forensics, LLC (September 2015 – Present)

Director of IT Security
Kern Community College District (June 2016 – Present)

Director of Technology Services
Madera Unified School District (September 2013 – June 2016)

Manager, Online Education Systems
Merced College (September 2006 – September 2013)

Network Test Engineer
Front Porch, Sonora, CA (March 2005 - September 2006)

Programmer/Analyst
Merced College - Merced, CA (September 2002 - March 2005)


Licenses

Certifications:

EnCase Certified Examiner (EnCE), #15-0815-6750
Magnet Certified Forensics Examiner (MCFE) – AXIOM
GIAC Security Leadership (GSLC)
Certified Information Systems Security Professional (CISSP), #441200
CompTIA Security+


Legal Experience & Services

Mr. Alexander has worked on civil and criminal cases involving wire fraud, embezzlement, business disputes, personal injury, street crime, harassment, restraining orders, and child pornography.

He also has experience with internal (HR) investigations involving acceptable use violations and sexual harassment.


Affiliations

National Association of Criminal Defense Lawyers (Investigator)
California Attorneys for Criminal Justice (Expert)
International Information System Security Certification Consortium - (ISC)²


Seminars & Training

Training Completed
• Magnet AXIOM Advanced Mobile Forensics (2020)
• Magnet AXIOM Advanced iOS Investigations (2020)
• Magnet AXIOM Advanced Computer Forensics (2020)
• Magnet AXIOM Incident Response Examinations (2020)
• Autopsy [forensics software] Basics and Hands-On - Basis Technology (2020)
• Snapchat Investigations and Forensics - PATCtech (2020)
• Cellular Records Analysis and Mapping - PATCtech (2019)
• Security Leadership Essentials - SANS (2019)
• Security Operations on AWS - Amazon (2018)
• Magnet AXIOM Examinations - Magnet Forensics (2017)
• First Responder Workshop – SecureWorks (2017)
• Practical Introduction to Cyber Security Risk Management – SANS (2016)
• Windows Security and Forensics – Microsoft Virtual Academy (2016)
• Advanced Internet Examinations – Guidance Software (2016)
• EnCase Examinations of the Macintosh Operating Systems - Guidance Software (2015)
• EnCase Certified Examiner Prep Course, Guidance Software (2015)
• Forensics II, Guidance Software (2015)
• Forensics I, Guidance Software (2015)
• Certified Ethical Hacker, Secure Ninja (2014)
• CISSP Review, Fishnet Security (2012)
• Microsoft SQL Server 2008, Webucator (2009)
• Introduction to Microsoft T-SQL, Webucator (2009)
• Ultimate Hacking Expert: Black Hat (2006)


Publications

Presentations
• KCCD Cloud Initiative: A Mid-Journey Update, CISOA Conference 2021
• Windows and AD Security, CISOA Conference 2021
• Security and Infrastructure in AWS, Chief Information Systems Officers Association - March 2020
• Ransomware: Preventing an Enterprise-wide Attack, Chief Information Systems Officers Association - March 2020
• Threat Modeling and ATT&CK, Chief Information Systems Officers Association - March 2019
• Passwords and Threat Modeling, CCC Information Security Workshop – July 2017
• Digital Forensics Procedures and Imaging, CCC Information Security Workshop – January 2017
• Detecting and Investigating Inappropriate Behavior on the Network, CETPA 2015
• Staying Safe Online, Summer Tech 2015

Publications
• Preserving Digital Evidence. Res Ipsa Loquitur (Kern County Bar), October 2017.
• Defeating Compiler-Level Buffer Overflow Protection. ;login:, 30(3): 59-71, 2005 Jun.
• Finding Malware on Compromised Windows Machines. ;login:, 30(2): 6-10, 2005 Apr.
• The Importance of Securing Workstations. ;login:, 30(1): 23-26, 2005 Feb.
• Improving Security with Homebrew System Modifications. ;login:, 29(6): 26-32, 2004 Dec.
• Password Protection for Modern Operating Systems. ;login:, 29(3): 23-33, 2004 Jun.
• Avoiding Buffer Overflows and Related Problems. ;login:, 29(1): 14-21, 2004 Feb.


Professional References

Available on request


Education

Master of Science in Computer Science, Capitol Technology University
With Honors

Master of Science in Information Assurance & Security, Capella University
Specialization: Digital Forensics

Bachelor of Science in Information Technology, Capella University
Specialization: Information Assurance and Security

Associate of Arts in General Studies, Merced College


Articles Published by Trace Digital Forensics, LLC

Link What Is Computer Hacking?

With the recent Van Buren decision, the Supreme Court limited the scope of the Computer Fraud and Abuse Act and brought it more in line with what security experts would understand to be "hacking". But, what does that mean?

Read Article

Link Understanding NCMEC CyberTipline Reports

Investigations into child pornography offenses often begin with the receipt of a CyberTipline Report from the National Center for Missing and Exploited Children (NCMEC). Both prosecutors and defense attorneys should be familiar with these reports and the information they can contain.

Read Article

Link Computer Forensics and Sentencing Criteria in Child Pornography Cases

In child pornography cases, attorneys often rely on computer forensic examiners to look for evidence that a suspect or defendant possessed or shared contraband material. The sentencing criteria in these cases can be complex so it is important that attorneys convey to the examiner what to look for and how to report it.

Read Article

Link Identifying a Person Using an IP Address

Cases such as copyright violations, computer hacking, and distribution of child pornography often involve using an individual's IP address to identify them. But, what is an IP address and how reliable are they at identifying individuals?

Read Article

Link Understanding Deleted Files and What They Mean

Attorneys who need to read and understand reports by computer forensics professionals and/or who need to present recovered files as evidence should understand how files are stored on computers and mobile devices, what happens when they are deleted, how they can be recovered, and know the limits on file recovery.

Read Article



Find an Expert Witness