William Ellwood

William Ellwood

Forensic Lead, CISO
CISSP, EnCE CCPA

[email protected]
(416) 410-1441

William is the Forensic Lead and Chief Information Security Officer for ellwood Evidence Inc., a digital forensic and incident response consultancy. He works with firms to improve their security posture, and to identify, isolate and remediate cyber-threats. Through their work with law enforcement, regulatory agencies, litigators and criminal defense firms, he has provided insight into the technical aspects of online fraud and cyber-theft.

With fifteen years of experience in information technology, ediscovery, digital forensics and digital security, William has implemented and investigated a wide range of technologies as they apply to legal matters. He holds a Bachelors of Science in Computational Cognition from Trinity College, University of Toronto. He is a Certified Information System Security Professional and Ontario-licensed Private Investigator.

Court Appearances

contested, Kanwal v. Zaman, before Justice A. Ramsay, Ontario Superior Court of Justice, Family Court. qualified to give expert opinion in the area of digital forensic science, specifically mobile device extraction and analysis.

on consent, S.J. v. His Majesty the King 2024, before Justice F. A. Valente, Ontario Court of Justice, Thunder Bay, Northwest Region. Qualified on consent to give expert opinion evidence in the area of digital forensic science.

on consent, R.D. v. Her Majesty the Queen 2022, before Chief Justice Wiebe, Provincial Court of Manitoba, for the Winnipeg Police Service as an expert in:

  • the search of materials, including digital and internet based materials, servers and other technological devices including laptops, iPads, digital cameras and USB sticks

  • data retrieval, isolation, preservation and destruction processes once material is seized

William has provided support in many cases over the years.  A common engagement is in the review of digital evidence and assisting defense counsel to understand the evidence and testimony of opposing experts then to prepare a cross examination strategy.  

William has also provided digital forensic expertise to many matrimonial, employment law/HR, criminal fraud and civil litigation cases.

Since 2019 William’s forensic team became the principle vendor of digital forensic and eDiscovery services to the Law Society of Ontario (LSO). The LSO has engaged his team in over 200 cases since 2019 ranging from mobile device data preservation and examination to web site and cloud resource preservation and examination to analysis of the authenticity of digital evidence and expert reporting for the LSO Tribunal.

Conferences & Seminars

Panelist

Featured
Osgoode Professional Development
The Twelve Minute Civil Litigator
Osgoode Professional Development

Delivered a presentation titled "Working with Digital Evidence in the Era of AI" at the Law Society of Ontario's Twelve Minute Civil Litigator 2024, focusing on AI's impact on digital evidence, including challenges in authenticity, provenance, and the potential for AI-assisted solutions in forensic analysis and legal review.

Osgoode Professional Development
Osgoode Professional Development
The Osgoode Certificate in E-Discovery, Information Governance and Privacy
Osgoode Professional Development

Updated and delivered the Collection, Preservation and Processing material as faculty for the Osgoode certificate program.

Osgoode Professional Development
Osgoode Professional Development
The Osgoode Certificate in E-Discovery, Information Governance and Privacy
Osgoode Professional Development

Created and taught the Collection, Preservation and Processing material as faculty for the Osgoode certificate program.

Osgoode Professional Development
2022 Tech Crimes and Electronic Evidence Symposium
Disclosure and Detention of Things Seized, Section 490 CC
2022 Tech Crimes and Electronic Evidence Symposium

Section 490C of the criminal code addresses the requirements surrounding return of seized items. We explore the issues which may arise when seized items are repositories of digital data.

2022 Tech Crimes and Electronic Evidence Symposium
25th Annual Fraud and Anti-Counterfeiting Conference
Protecting your Business/Workplace from Fraud
25th Annual Fraud and Anti-Counterfeiting Conference

From preventing phishing to ensuring online safety and physical safety within your office/home office premises, education of staff to protect against fraudsters.

25th Annual Fraud and Anti-Counterfeiting Conference

Advancing the Industry

Papers

Featured
Sedona Canada - Sedona Canada Commentary on Discovery of Social Media

Forthcoming. My primary contribution was updating and revising the sections on ephemeral messaging, preservation and presentation.

Sedona Canada - Commentary on Privacy and Information Security for Legal Service Providers: Principles and Guidelines

In this commentary, the Sedona Canada working group on Privacy and Information Security attempted to make the nitty-gritty of information security as approachable as possible, with practical tips for securing law-firms large and small.

Teaching

Osgoode Professional Development, 2019 - Present

Teaching the Collection, Preservation and Processing section in the Osgoode Certificate in E-Discovery, Information Governance and Privacy. Regular panelist and presenter.

Guidance Software Part-Time Trainer, 2014 - 2018

Instructed the EnCE Preparation Class at Guidance’s Dulles Virginia facility. Regularly facilitated virtual classroom instruction. Graded EnCE examinations.

Committees

Featured
International Association of Computer Investigative Specialists
International Association of Computer Investigative Specialists

IACIS is a non-profit, volunteer organization wholly dedicated to training, certifying and providing membership services to computer forensic professionals around the world.

Digital Evidence & EDiscovery Working Group
Digital Evidence & EDiscovery Working Group

The mandate of the Digital Evidence and eDiscovery Working Group is to recommend, promote and, where possible, implement thought leadership, best practices and law reform with respect to information management, discovery, litigation support and paperless proceedings.

High-Technology Crime Investigation Association
High-Technology Crime Investigation Association

The High Technology Crime Investigation Association (HTCIA) was created in 1986 and is the oldest association solely focused on high tech investigations. HTCIA is an organization that provides education and collaboration to our members for the prevention and investigation of high tech crimes.

The Sedona Conference - Working Group 7
The Sedona Conference - Working Group 7

The mission of Working Group 7 is to create forward-looking principles and best practice recommendations for lawyers, courts, businesses, and others who regularly confront e-discovery issues in Canada.

Attendee

Featured
EnFuse 2019

Bringing together thought-leaders in cybersecurity, digital investigations, AI and eDiscovery to discuss best practices, Enfuse 2019 offered more than 100 breakout sessions and hands-on technical labs.

The Investigators' Guide to Testifying in Non-Criminal Legal Proceedings

A comprehensive overview of all the key steps that go into giving effective testimony. An experiential learning day with numerous opportunities to practice testimony and individualized feedback from experienced counsel.

12th National Symposium on Tech Crime and Electronic Evidence

Disseminating information and techniques to more effectively investigate, prosecute, defend or adjudicate technology and internet crimes.

Blackhat 2017

Black Hat is the world’s leading information security event, providing attendees with the very latest in research, development and trends.

Computer and Enterprise Investigations Conference 2014

CEIC brings together security, e-discovery and forensic investigation professionals for in-depth discussions on security with industry experts representing leading government agencies and corporations from around the world.

Computer and Enterprise Investigations Conference 2013

CEIC is one of the largest international gatherings with a focus on the latest developments in cybersecurity, digital investigations and e-discovery.

Certifications & Professional Education

Digital Forensics

Featured
IACIS Certified Mobile Device Examiner
IACIS Certified Mobile Device Examiner

The IACIS Certified Mobile Device Examiner (ICMDE) Certification evaluates a set of core competencies including preservation, foundational technology, examination methodology, and vendor-agnostic assessment on Android and iOS devices by written and practical examination.

Recon-3D Online Certificate
Recon-3D Online Certificate

The Recon-3D training program covers some of the best practices of spatial capture scanning with photogrammetry and Recon-3D's novel LiDAR sensor fusion engine, and how to assure the accuracy of your 3D point cloud data.

Cellebrite Certified Physical Analyst
Cellebrite Certified Physical Analyst

The Cellebrite Certified Physical Analyst (CCPA) course is a 3-day advanced level program designed for technically savvy investigators, digital evidence analysts and forensic practitioners. Physical Analyzer software will be used extensively to explore recovered deleted data, database contents, advanced search and analysis techniques, verification and validation, and reporting.

Cellebrite Certified Operator
Cellebrite Certified Operator

The CCO is a 2-day intermediate level certification program which is designed to teach with extracting data in a forensically sound manner using UFED Touch or UFED 4PC. It aims to teach digital forensic examiners data extraction techniques across a variety of devices.

Certified Forensic Security Responder (CFSR) [In Progress]
Certified Forensic Security Responder (CFSR) [In Progress]

The CFSR certification acknowledges professionals who have mastered the necessary skills to prepare for cyber-attacks, perform attack detection, validate and prioritize alerts and contain cyber incidents. In addition, it demonstrates the professional’s ability to conduct root cause analysis, manage a cyber breach remediation process, and evaluate lesson learned.

Certified Information Systems Security Professional (CISSP)
Certified Information Systems Security Professional (CISSP)

The CISSP is a rigorous, vendor-neutral program that demonstrates competence across eight IT security domains. It is the NSA’s certification baseline for information security and policy management.

Passware Kit Forensic Certification
Passware Kit Forensic Certification

… apply Passware in different scenarios, to include, encrypted files, email passwords, Windows passwords, Apple passwords, encrypted volumes and more.

EnCase Certified Examiner ( EnCE)
EnCase Certified Examiner ( EnCE)

The EnCase® Certified Examiner(EnCE®) program certifies both public and private sector professionals in the use of Guidance Software's EnCase computer forensic software. EnCE certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.

eDiscovery

Featured
Nuix Workstation Discovery Core
Nuix Workstation Discovery Core

The foundational knowledge for effective use of Nuix Workstation, to create cases, data process, search and review content.

Certified EDT Site Administrator (CESA)
Certified EDT Site Administrator (CESA)

the most comprehensive of EDT’s certifications, CESA includes all other EDT training content for those responsible for administration of the entire EDT environment.

Relativity Certified Administrator 8.3
Relativity Certified Administrator 8.3

The Relativity Certified Administrator (RCA) program ensures that case administrators fully understand Relativity’s capabilities, allowing you to maximize the software’s flexibility and provide an intuitive interface for end users.

EnCase Certified eDiscovery Practitioner (EnCEP)
EnCase Certified eDiscovery Practitioner (EnCEP)

The EnCase® Certified eDiscovery Practitioner(EnCEP®) program certifies private and public sector professionals in the use of Guidance Software's EnCase® eDiscovery software as well as their proficiency in e-discovery planning, project management, and best practices, spanning legal hold to load file creation. EnCase eDiscovery is the leading e-discovery solution for the search, collection, preservation, and processing of electronically stored information(ESI). Earning the EnCEP certification illustrates that a practitioner is skilled in the application of the solution to manage and successfully complete all sizes of e-discovery matters in accordance with the Federal Rules of Civil Procedure.

Forensics Training

Cellebrite

Cellebrite Certified Physical Analyst (CCPA)
Cellebrite Certified Operator (CCO)

Sumuri / Passware

Surviving Encryption

Guidance Software

EnCase eDiscovery
EnCase CyberSecurity
EnCase Enterprise
Network Intrusion Investigations
Advanced Internet Investigations
Advanced Computer Forensics
Computer Forensics II
Computer Forensics I

eDiscovery Training

kCura

Relativity Analytics
Relativity Infrastructure
Relativity Processing
Relativity Assisted Review

edt.

edt Platform Administration

Experience & Education

Professional Experience

ellwood Evidence Inc.
Forensic Lead, CISO (2018 - present)
Senior Examiner (2013 - 2018)
Forensic Examiner (2011 - 2013)

Guidance Software
Part-Time Forensic Trainer (2014-2018)

ellwood Associates Inc.
Solutions Architect (2011-2013)
Support Administrator (2009-2011)

Education

University of Toronto, Trinity College
Bachelor of Science, Computational Cognition (2012-2017)

ExaminerWilliam Ellwood, EnCEBio, William Ellwood