Stephen J. Ellwood




Qualified as an Expert in Digital Forensics by the Superior Court of Justice

Steve has over 35 years of experience and expertise in the design, implementation and maintenance of information systems, Internet architecture, email systems, and database systems. Spanning the entire personal computing era, his work has covered all areas of technology: hardware, software, online, mobile, and traditional and IP based telephony. 

Steve is the founder and Principal of ellwood Associates Inc. (eAI) and its family of companies. Since eAI’s beginnings in 1984, Steve has built it into a ‘best in class’ enterprise specializing in technology for the legal community in Canada. With his team of 14 consultants out of Toronto, Steve and eAI have served as the principal contractor or consultant on technology-related projects for over 200 large and small law firms, for government, and for corporate legal departments. His work has included:

o    advising lawyers and other professionals on technology
o    designing, implementing and maintaining technology infrastructures
o    designing, implementing and maintaining knowledge and information systems
o    developing strategies and systems for the forensic use of information technology
o    advising on and implementing technology security
o    implementing and maintaining document management systems
o    implementing and maintaining Internet services, including email and ISP mail servers
o    installing and configuring software systems
o    designing, installing and maintaining database and information systems.

Specializing digital forensics and preservation, collection and examination of electronic evidence, Steve is engaged in passing on his unique skills, experience and knowledge to the next generation of examiners in North America.

In addition to his work at eAI, Steve: 
o    founded and operated one of Canada’s first Internet service providers, Internet Connect Niagara, which served more than 10,000 users, including major enterprises; led, designed and created the significant Niagara Hospital Rbase relational database system covering the regional hospital’s 3,000 patients;
o    brought Sheraton Hotels Worldwide to the Internet with a portfolio of over 400 properties;
o    served as special consultant to the 2002 International Litigation Forum in Geneva Switzerland.


o    University of Western Ontario Dean’s List graduate B.A. (honours) in Economics (1986)

o    Post Graduate Diploma in Management, Henley School of Business, University of Reading UK (2018)

Certifications and EDUCATION

Digital Forensics

o    Magnet Certified Forensics Examiner (2018)

Showcase your expert knowledge of Magnet Internet Evidence Finder (IEF) by achieving the MCFE – IEF. This certification shows your exceptional competence with our premier artifact searching and recovering tool.

o    Cellebrite Certified Operator (2015)

The Cellebrite Certified Operator (CCO) course is a 2-day intermediate level certification program which builds on the concepts from the CMFF course. This course is designed for those participants tasked with extracting data in a forensically sound manner using UFED Touch or UFED 4PC. This course aims to teach data extraction team members such as technically savvy investigators, digital forensic examiners, IT staff, internal affairs investigators, first responders and personnel designated to handle extraction of digital evidence how to perform extractions on a variety of devices. These extractions include logical, file system and physical extractions from mobile devices as well SIM cards, and external storage such as SD cards. Participants in this course will gain a basic understanding of how to open the extractions in Physical Analyzer software, conduct basic searches and how to create bookmarks and reports.

o    EnCase Certified Examiner EnCE (2011)
      - Appointed eDiscovery Software Instructor, Guidance Software (2012)

The EnCase Certified Examiner (EnCE) program certifies both public and private sector professionals in the use of Guidance Software's EnCase computer forensic software. EnCE certification acknowledges that professionals have mastered computer investigation methodology as well as the use of EnCase software during complex computer examinations. Recognized by both the law enforcement and corporate communities as a symbol of in-depth computer forensics knowledge, EnCE certification illustrates that an investigator is a skilled computer examiner.

o    Access Data LLC - certified completed Access Data Forensics ToolKit Continuing Education Seminars (2011)

o    X1 Social Discovery - National White-Collar Crime Centre (2012)


o    EnCase Certified eDiscovery Practitioner (2014)

The EnCase Certified eDiscovery Practitioner (EnCEP) program certifies private and public-sector professionals in the use of Guidance Software's EnCase eDiscovery software as well as their proficiency in e-discovery planning, project management, and best practices, spanning legal hold to load file creation. EnCase eDiscovery is the leading e-discovery solution for the search, collection, preservation, and processing of electronically stored information (ESI). Earning the EnCEP certification illustrates that a practitioner is skilled in the application of the solution to manage and successfully complete all sizes of e-discovery matters in accordance with the Federal Rules of Civil Procedure.

o    Concordance Certified Administrator, Certified Trainer (2009)

o    Lexis Nexis Early Data Analyzer- Administrator/EDD (2015)

o    Summation- Summation Enterprise (SQL) Administrator (2009)

o    Case Soft (now Lexis Nexis) - Certified Support in CaseMap, TextMap, NoteMap, DepoMap, TimeMap

Law Firm Practice Management

o    Lexis Nexis TimeMatters - Certified Independent Consultant in TimeMatters v6, v7, v8, v9 & v10 Professional, Enterprise (SQL) v7 and v8 and WorldServer (Web) v8 

o    Amicus Attorney Premier Consultant

o    inData LLC - TrialDirector - Certified Trainer and Administrator

o    LiveNote - Certified admin and trainer

General IT

o    Novell Certified Engineer (v.2/3/4)
o    WordPerfect Certified Resource

Professional Course work:

●    Principles of Digital Forensic Investigation of Windows Computers, Mobile and Cloud evidence using Magnet Forensics Internet Evidence Finder (IEF), and Axiom Applications as Tools

○    Internet Evidence Finder (IEF-200) (2018)
       Online 4 days - 32 hours
○    Portable Case for the Investigator (2018)
       Online 1 hour
○    Office 365 and Cloud Based Investigations using Axiom (2018)
       Online 2 days

●    Principles of Digital Forensic Investigation of Mobile devices using Cellebrite Applications as Tools

○    Cellebrite Mobile Forensics Fundamentals (2015)
        Online 2 days
○    Cellebrite Certified Logical Operator (2015)
       Online 2 days

●   Principles of Digital Forensic Investigation using EnCase Applications as Tools

o    First Responder Training (2011)
        Chicago IL 3 days
o    Computer Forensics I v6 (2011)
       Chicago IL 4 days
o    Computer Forensics II V6 (2011)
       Chicago IL 4 days
o    Advanced Computer Forensics (2011)
       Chicago IL 4 days
o    Examination of Windows NTFS File System (2011)
       Chicago IL 4 days
o    EnCE Certification Preparation Course (2011)
       Houston TX 4 days
o    Macintosh/Linux Examinations (2011)
       Washington DC 4 days
o    EnCase Enterprise Examinations v7 (2011)
       Chicago IL 4 days
o    EnCase Advanced Internet Investigations (2011)
       Washington DC 4 days
o    EnCase Cybersecurity v4 (2011)
       Chicago IL 4 days
o    Network Intrusion Investigations (2011)
       Chicago IL 4 days
o    EnCase Enterprise Examinations v6 (2012)
       Houston TX 4 days
o    EnCase eDiscovery v4 (2012)
       Houston TX 4 days
o    Computer Forensics I V7 (2013)
       Online 4 days
o    Computer Forensics II V7 (2013)
       Online 4 days
o    EnCase Cybersecurity v5 Train the Trainer program (2013)
       Los Angeles CA 5 days
o    Computer Forensics I V7 (2014)
       Orlando FL 4 days
o    Computer Forensics II V7 (2014)
       Orlando FL 4 days
o    EnCase eDiscovery v5 (2015)
       Los Angeles CA 4 days
       Mr. Ellwood co-authored the certification exam with David Neal of Guidance Software
o    EnCase DF210 Building an Investigation v8 (2016)
       Online 4 days
o    EnCase DF420 Apple Macintosh Examinations v8 (2017)
       Online 4 days
o    EnCase DF410 Windows NTFS Examinations v8 (2017)
       Online 4 days

●    Encase Product Knowledge Course Work

o    EnCase Portable Configurations and Examinations (2011)
       Houston TX 3 days
o    EnCase DF220 Navigating EnCase Forensic v8 (2016) 
       Online 4 days

●    Principles of Investigation of Cyber Security Incidents using Security Onion as an Investigative Tool

○    Introduction to the Security Onion 101 (2017)
       Online 1 days
○    Best Practices for Distribution Production Sensors 201 (2017)
       Online 1 day
○    Case Studies 202 (2017)
       Online 1 day
○    Best Practices for Distribution Deployment 301 (2017)
       Online 1 day

●    Principals of Digital Forensics as it Applies to internet Based Social Media using X1 Social Discovery and a Collection and Investigative Tool (2012)
○    National White Collar Crimes Center, Fairmont, WV 4 days
●    Access Data LLC- certified completed Access Data Forensics ToolKit Continuing
 Education Seminars (2011)

●    Microsoft - Microsoft SQL 2005 Database Administrator – incomplete

●    Novell Certified Engineer (v.2/3/4)

●    WordPerfect certified resource and trainer

Continuing Education Conferences

o    CEIC Digital Forensics Conference (2012)
       Las Vegas 4 days
       32 hours Continuing Professional Education Credit in Digital Forensics

o    CEIC Digital Forensics Conference (2013)
       Las Vegas 4 days
       32 hours Continuing Professional Education Credit in Digital Forensics

o    AccessData User Conference (2014)
      Las Vegas 4 days
      32 hours Continuing Professional Education Credit in eDiscoverys

o    CEIC Digital Forensics Conference (2014)
       Las Vegas 4 days
       32 hours Continuing Professional Education Credit in Digital Forensics

o    CEIC Digital Forensics Conference (2015)
       Las Vegas 4 days
       32 hours Continuing Professional Education Credit in Digital Forensics

o    EnFuse Digital Forensics Conference (2017)
       Las Vegas 4 days
       32 hours Continuing Professional Education Credit in Digital Forensics

Other Courses and Seminars

●    Courtroom Testimony: A Practical Skills Workshop for Police and Other Law Enforcement Professionals - Osgoode Hall York University December 2016 


●    Advocates Society Journal

○    2012 - “Sample Separation Agreement Precedent Social Media Provisions” co-written with Ronald D. Davis Ph.D. JD, Phil M. Epstein and Howard Feldman

○    June 2013 - “Lawyers on the beach: The standard of care, technology, and the oncoming digital tsunami” co-written with Ronald D. Davis Ph.D. JD

○    Spring 2014 - “10 things every litigator has to know about social media, or: Why you have nothing to fear and much to gain” co-written with Ronald D. Davis Ph.D. JD

●    Journal of the British Columbia Paralegal Association

○    Winter 2016 – “CaseMap: A Litigation Case Management Thinking Tool” co-written with Stephanie Williams, Volume 47, Issue 3, Paralegal Press, Winter 2016/2017

Work within the Legal Process

Steve has provided support in many cases over the years.  His most common engagement is in the review of digital evidence and assist defense counsel to understand the evidence and prepare a cross examination strategy.  

Steve from time to time will attend with defense counsel to hear the In Chief testimony of Crown witnesses to assist defense counsel.

Steve has also provided digital forensic expertise to many matrimonial, employment law/HR, criminal fraud and civil litigation cases.

Certified as an expert qualified to give opinion regarding:
•    Forensic analysis of digital evidence

on consent in Wang v Hao 2018 Arbitration before Retired Justice Bruce Glass, Superior Court of Justice, (Central Eastern Region-Durham Region) 

Certified as an expert qualified to give opinion regarding:
•    Forensic analysis of digital evidence,
•    Acquisition and analysis of digital evidence,
•    Acquisition and analysis of mobile device and their digital evidence,
•    Internet evidence analysis;

on consent in R. v Joseph 2018 before Justice Colin D. A. McKinnon (Superior Court of Justice East region)

Certified as an expert qualified to give opinion with respect to the use of Encase software and other forensic tools used in the examination of digital evidence
●    R. v Ricky Allen Patterson 2018 before by Justice Peter Bawden Superior Court of Justice

Certified as an Expert in Computer Systems and Email Systems December 2016
●    PriceWaterhouseCoopers v. Elisabeth Burke Binding Arbitration before Thomas Heintzman

Legal Aid Ontario Vendor of Record since 2015 for:
•    Analysis of digital evidence

Steve’s criminal casework includes;

Henein Hutchinson LLP
●    R. v. Crichton
●    R. v. Dhaliwal
●    R. v. Capito
●    R. v. Zhang

Cooper Sandler Shime & Bergman LLP
●    R. v. Paramalingam and Jaffer, 2016 CanLII 18784 (ON SC)
●    R. v. Kenneth James, 2013 ONSC 5085 (CanLII)
●    R. v. Gatto

Dentons and later Heller Rubel Barristers
●    R. v. Ghomeshi, 2016 ONCJ 155 (CanLII)

Dan Johnson Criminal Lawyer
●    R. v. Messon
Defence Counsel Services Judge Advocate General, Department of Defence Canada
•    R v. Whalen
•    R v. Hansen
Lyttle McGarry Del Greco LLP
•    R v Dubois
Robert Richardson Barrister and Solicitor
●    R. v. Reza
Bernhardt Fitzgerald Barrister and Solicitor
●    R. v. Patterson
Jeff Carolin Barrister and Solicitor
●    R. v. Duru

The list of civil cases Steve has been involved in is lengthy.  Steve regularly provides digital forensic and eDiscovery expertise as a consultant to;

●    Addario Law Group LLP
●    Barnable Law PC
●    Bennett Jones LLP
●    Berkow Cohen LLP
●    Black and Sutherland LLP
●    Borden Ladner Gervais LLP
●    Carolyn A. MacLean Barrister & Solicitor
●    Cassels Brock & Blackwell LLP
●    Cooper Sandler Shime & Bergman LLP
●    Canadian National Railway
●    Dan Johnson Criminal Lawyer
●    Dentons LLP
●    Epstein Cole LLP
●    Falconeri Munro Tucci LLP
●    Fogler Rubinoff LLP
●    Fasken Martineau LLP
●    Forget Smith Morel LLP
●    Heal and Company LLP
●    Henein Hutchinson LLP
●    Heller Rubel Barristers
●    Jeff Carolin Barrister and Solicitor
●    John Christie Barrister and Solicitor
●    Kestenberg Siegal Lipkus LLP
●    Lenczner Slaght Royce Smith Griffin LLP
●    Martha McCarthy LLP
●    Matthews Abogado LLP
●    Minken Employment Lawyers LLP
●    Robert Richardson Barrister and Solicitor
●    Paliare Roland Rosenberg Rothstein LLP
●    Stephen Durbin & Associates
●    Stevenson Whelton MacDonald & Swan LLP
●    Stikeman Elliott LLP
●    Sutts Strosberg LLP
●    Templeman Menninga LLP
●    Teplitsky Colson LLP
●    The Law Studio LLP
●    Wadle Daley Bernstein Bieber LLP
●    Wagner Sidlofsky LLP
●    among others leading Canadian law firms and Canadian corporations