William Ellwood

William Ellwood

Forensic Lead, CISO
CISSP, EnCE CCPA

[email protected]
(416) 410-1441

William is the Forensic Lead and Chief Information Security Officer for ellwood Evidence Inc., a digital forensic and incident response consultancy. He works with firms to improve their security posture, and to identify, isolate and remediate cyber-threats. Through their work with law enforcement, regulatory agencies and criminal defense firms, he has provided insight into the technical aspects of online fraud and cyber-theft.

With fifteen years of experience in information technology, ediscovery, digital forensics and digital security, William has implemented and investigated a wide range of technologies as they apply to legal matters. He holds a Bachelors of Science in Computational Cognition from Trinity College, University of Toronto. He is a Certified Information System Security Professional and Ontario-licensed Private Investigator.

Court Appearances

on consent, R.D. v. Her Majesty the Queen 2022, before Chief Justice Weibe, Provincial Court of Manitoba, for the Winnipeg Police Service as an expert in:

  • the search of materials, including digital and internet based materials, servers and other technological devices including laptops, iPads, digital cameras and USB sticks

  • data retrieval, isolation, preservation and destruction processes once material is seized

Conferences & Seminars

Panelist

Featured
Osgoode Professional Development
The Osgoode Certificate in E-Discovery, Information Governance and Privacy
Osgoode Professional Development

Created and taught the Collection, Preservation and Processing material as faculty for the Osgoode certificate program.

Osgoode Professional Development
2022 Tech Crimes and Electronic Evidence Symposium
Disclosure and Detention of Things Seized, Section 490 CC
2022 Tech Crimes and Electronic Evidence Symposium

Section 490C of the criminal code addresses the requirements surrounding return of seized items. We explore the issues which may arise when seized items are repositories of digital data.

2022 Tech Crimes and Electronic Evidence Symposium
25th Annual Fraud and Anti-Counterfeiting Conference
Protecting your Business/Workplace from Fraud
25th Annual Fraud and Anti-Counterfeiting Conference

From preventing phishing to ensuring online safety and physical safety within your office/home office premises, education of staff to protect against fraudsters.

25th Annual Fraud and Anti-Counterfeiting Conference
Osgoode Hall Professional Development
E-Discovery, Information Governance and Privacy: Data Preservation & Processing
Osgoode Hall Professional Development

Presented developments in In-Place Data Search, Litigation Holds and modern document processing and analytics solutions as part of The Osgoode Certificate in E-Discovery, Information Governance and Privacy.

Osgoode Hall Professional Development
Intellectual Property Institute of Canada
The New Balancing Act: Staying Cyber-Safe Wherever You Are
Intellectual Property Institute of Canada

An overview of key challenges and unique security threats associated with remote access and adopting best practices to protect small ad mid-sized firms (and their clients) against fraudsters. Checklists and worksheets provided to kickstart security programs.

Intellectual Property Institute of Canada

Advancing the Industry

Papers

Featured
Sedona Canada - Sedona Canada Commentary on Discovery of Social Media

Forthcoming. My primary contribution was updating and revising the sections on ephemeral messaging, preservation and presentation.

Sedona Canada - Commentary on Privacy and Information Security for Legal Service Providers: Principles and Guidelines

In this commentary, the Sedona Canada working group on Privacy and Information Security attempted to make the nitty-gritty of information security as approachable as possible, with practical tips for securing law-firms large and small.

Teaching

Osgoode Professional Development, 2019 - Present

Teaching the Collection, Preservation and Processing section in the Osgoode Certificate in E-Discovery, Information Governance and Privacy. Regular panelist and presenter.

Guidance Software Part-Time Trainer, 2014 - 2018

Instructed the EnCE Preparation Class at Guidance’s Dulles Virginia facility. Regularly facilitated virtual classroom instruction. Graded EnCE examinations.

Committees

Featured
The Sedona Conference - Working Group 7
The Sedona Conference - Working Group 7

The mission of Working Group 7 is to create forward-looking principles and best practice recommendations for lawyers, courts, businesses, and others who regularly confront e-discovery issues in Canada.

Attendee

Featured
EnFuse 2019

Bringing together thought-leaders in cybersecurity, digital investigations, AI and eDiscovery to discuss best practices, Enfuse 2019 offered more than 100 breakout sessions and hands-on technical labs.

The Investigators' Guide to Testifying in Non-Criminal Legal Proceedings

A comprehensive overview of all the key steps that go into giving effective testimony. An experiential learning day with numerous opportunities to practice testimony and individualized feedback from experienced counsel.

12th National Symposium on Tech Crime and Electronic Evidence

Disseminating information and techniques to more effectively investigate, prosecute, defend or adjudicate technology and internet crimes.

Blackhat 2017

Black Hat is the world’s leading information security event, providing attendees with the very latest in research, development and trends.

Computer and Enterprise Investigations Conference 2014

CEIC brings together security, e-discovery and forensic investigation professionals for in-depth discussions on security with industry experts representing leading government agencies and corporations from around the world.

Computer and Enterprise Investigations Conference 2013

CEIC is one of the largest international gatherings with a focus on the latest developments in cybersecurity, digital investigations and e-discovery.

Certifications & Professional Education

Digital Forensics

Featured
Cellebrite Certified Physical Analyst
Cellebrite Certified Physical Analyst

The Cellebrite Certified Physical Analyst (CCPA) course is a 3-day advanced level program designed for technically savvy investigators, digital evidence analysts and forensic practitioners. Physical Analyzer software will be used extensively to explore recovered deleted data, database contents, advanced search and analysis techniques, verification and validation, and reporting.

Cellebrite Certified Operator
Cellebrite Certified Operator

The CCO is a 2-day intermediate level certification program which is designed to teach with extracting data in a forensically sound manner using UFED Touch or UFED 4PC. It aims to teach digital forensic examiners data extraction techniques across a variety of devices.

Nuix Workstation Discovery Core
Nuix Workstation Discovery Core

The foundational knowledge for effective use of Nuix Workstation, to create cases, data process, search and review content.

Certified Forensic Security Responder (CFSR) [In Progress]
Certified Forensic Security Responder (CFSR) [In Progress]

The CFSR certification acknowledges professionals who have mastered the necessary skills to prepare for cyber-attacks, perform attack detection, validate and prioritize alerts and contain cyber incidents. In addition, it demonstrates the professional’s ability to conduct root cause analysis, manage a cyber breach remediation process, and evaluate lesson learned.

Certified Information Systems Security Professional (CISSP)
Certified Information Systems Security Professional (CISSP)

The CISSP is a rigorous, vendor-neutral program that demonstrates competence across eight IT security domains. It is the NSA’s certification baseline for information security and policy management.

Passware Kit Forensic Certification
Passware Kit Forensic Certification

… apply Passware in different scenarios, to include, encrypted files, email passwords, Windows passwords, Apple passwords, encrypted volumes and more.

EnCase Certified Examiner ( EnCE)
EnCase Certified Examiner ( EnCE)

The EnCase® Certified Examiner(EnCE®) program certifies both public and private sector professionals in the use of Guidance Software's EnCase computer forensic software. EnCE certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.

eDiscovery

Featured
Certified EDT Site Administrator (CESA)
Certified EDT Site Administrator (CESA)

the most comprehensive of EDT’s certifications, CESA includes all other EDT training content for those responsible for administration of the entire EDT environment.

Relativity Certified Administrator 8.3
Relativity Certified Administrator 8.3

The Relativity Certified Administrator (RCA) program ensures that case administrators fully understand Relativity’s capabilities, allowing you to maximize the software’s flexibility and provide an intuitive interface for end users.

EnCase Certified eDiscovery Practitioner (EnCEP)
EnCase Certified eDiscovery Practitioner (EnCEP)

The EnCase® Certified eDiscovery Practitioner(EnCEP®) program certifies private and public sector professionals in the use of Guidance Software's EnCase® eDiscovery software as well as their proficiency in e-discovery planning, project management, and best practices, spanning legal hold to load file creation. EnCase eDiscovery is the leading e-discovery solution for the search, collection, preservation, and processing of electronically stored information(ESI). Earning the EnCEP certification illustrates that a practitioner is skilled in the application of the solution to manage and successfully complete all sizes of e-discovery matters in accordance with the Federal Rules of Civil Procedure.

Forensics Training

Cellebrite

Cellebrite Certified Physical Analyst (CCPA)
Cellebrite Certified Operator (CCO)

Sumuri / Passware

Surviving Encryption

Guidance Software

EnCase eDiscovery
EnCase CyberSecurity
EnCase Enterprise
Network Intrusion Investigations
Advanced Internet Investigations
Advanced Computer Forensics
Computer Forensics II
Computer Forensics I

eDiscovery Training

kCura

Relativity Analytics
Relativity Infrastructure
Relativity Processing
Relativity Assisted Review

edt.

edt Platform Administration

Experience & Education

Professional Experience

ellwood Evidence Inc.
Forensic Lead, CISO (2018 - present)
Senior Examiner (2013 - 2018)
Forensic Examiner (2011 - 2013)

Guidance Software
Part-Time Forensic Trainer (2014-2018)

ellwood Associates Inc.
Solutions Architect (2011-2013)
Support Administrator (2009-2011)

Education

University of Toronto, Trinity College
Bachelor of Science, Computational Cognition (2012-2017)

ExaminerWilliam Ellwood, EnCEBio, William Ellwood