Party-appointed technical expertise on digital evidence
I am an engineer who spent twenty years building and running the systems that evidence is now extracted from: mail servers, databases, cloud infrastructure, applications serving millions of visits. I bring that experience to the party's side, in Italian civil and criminal proceedings.
- Order of Engineers of Rome, reg. no. 31345
- Electronic Engineering, Sapienza University of Rome
- Twenty years in infrastructure, systems and databases
- Rome, instructions accepted throughout Italy
When a party-appointed expert is needed
Four situations where the case turns on a technical detail
-
The other side has filed chat screenshots that our client denies writing.
A screenshot is the weakest form in which a conversation can reach a court: it carries nothing that establishes where it came from. It can be challenged — and, from the other side, it can be strengthened before it is filed. Chat and messaging →
-
Our client says he never sent that email, and the date does not add up.
An email carries its own route written inside it. Headers, DKIM signatures and SPF results say a great deal about who actually sent it — and Italian certified email follows rules of its own. Email and certified email →
-
The software delivered does not do what was agreed, and now we are accused of breach.
Establishing what a program actually does, when it was written and by whom is a technical exercise carried out on the code and on the repository history, not on the parties' assertions. Software and source code →
-
We suffered an intrusion: we need to know what actually left the building.
The logs usually hold the answer, but it has to be read with care: the gap between «data was reachable» and «data was copied» is the same gap that separates a risk from a compensable loss. Data breaches and log analysis →
Practice areas
Where I can be useful
Each area raises a different legal question and calls for a different method. Below you will find what can be established, how, and within what limits.
Forensic acquisition
Making a copy of a disk, a phone or a mailbox that will still stand up when the other side attacks it.
Chat and messaging
What a WhatsApp screenshot actually proves, and what has to be done to make it hold.
Email and certified email
Reading SMTP headers, SPF, DKIM and certified-email receipts to establish who really sent what.
Mobile devices
Extraction from smartphones and tablets: what can be recovered, what cannot, and why.
Software and source code
Disputes over development contracts, ownership of code and software that does not do what was agreed.
Artificial intelligence systems
Model outputs, inference logs and training data: what can genuinely be established about an AI system.
Data breaches and log analysis
Reconstructing an intrusion from the logs and separating what was taken from what was merely reachable.
Why a systems engineer
Whoever built those systems knows where to look
Digital forensics is not a laboratory discipline separate from ordinary computing: it is the same subject, examined with a different question in mind. A mail log, a database table, a file system are objects I administered for years, not surfaces to be interpreted from the outside.
That changes the questions that come to mind. Anyone who has kept a time service
running knows a server clock can drift by minutes. Anyone who has run a migration
knows that a last-modified timestamp records when a file was touched on that volume,
not when the document was written. Anyone who has configured Postfix knows that a
Received line added by their own server is a different kind of source
from one added by a third party's. These distinctions decide cases, and they are not
learned from a tool manual.
In recent years my work has centred on systems built around large language models — retrieval-augmented architectures, multi-agent systems, the production lifecycle of generative components. Litigation in this field is only now emerging, and very few technical experts can tell a court what is and is not capable of proof. Artificial intelligence systems →
Method
How an instruction is carried out
-
Framing
Before any data is touched: what has to be proved, which rule makes it relevant, which technical facts would support it. If the technical route does not lead where it needs to, it is better to know at once.
-
Acquisition
Data is copied by procedures that preserve its integrity and document its origin, so that the copy holds when the other side attacks it.
-
Analysis
The examination itself, carried out on copies and never on originals, using tools and steps another expert can repeat from the same starting material.
-
Report
A written report in plain language that draws a sharp line between what has been established, what is probable and what remains unknown — and that survives cross-examination.
One undertaking, given in advance. If the analysis does not support the instructing party's case, I say so before filing, not after. An accommodating report reveals itself in the hearing, when nothing can be done about it: that is not a service I offer.
Do you have a matter under way?
Tell me what happened and what you need to prove. In a first reply I will tell you whether there is a technical route, what data is needed and how long it takes — before any commitment.