HKA welcomes Dr. Gangjin Li to its Forensic Technical Services practice
31st March 2025
HKA is pleased to welcome Dr. Gangjin Li as a Director on its Forensic Technical Services team in Dallas, Texas.
Dr. Li is a geotechnical engineer with 15 years of consulting and academic research experience in civil infrastructure. He has worked on over 60 large-scale transportation projects throughout North America, requiring in-depth expertise in geotechnical analysis and design, forensic investigation, opportunity and risk assessments, peer review, and technical report preparation.
Dr. Li’s experience extends to numerical modeling, slope stabilization, and landslide mitigation. He is knowledgeable in the design of spread footings, driven piles, and drilled shafts for bridge and retaining wall foundations; the geotechnical design of earth-retaining structures, including cast-in-place concrete walls, mechanically stabilized earth walls, and sound walls; and short- and long-term settlement analysis for foundations and earth fills.
Additionally, he has conducted seismic hazard evaluations and structural vulnerability assessments and is experienced with constructability reviews, the selection of construction means and methods, and temporary works design.
“We are thrilled to welcome Dr. Li to our Forensic Technical Services team. His wealth of experience as a geotechnical engineer brings incredible expertise and insight to our organization. With Dr. Li on board, we are excited to expand our capabilities and provide enhanced services to our valued clients.”
Mike Griffin, Partner, Forensic Technical Services Lead, Americas
Dr. Li holds a Doctor of Philosophy in Geotechnical Engineering from the University of Nevada, Reno, as well as a Master of Science in Bridge and Tunnel Engineering and a Bachelor of Science in Civil Engineering from Tongji University in China. He is a licensed Professional Engineer in Alabama, California, Maryland, Nevada, New York, North Carolina, Texas, Virginia, and Washington.
HKA’s forensic engineering, architectural, and technical experts provide expert advisory, expert determination, and expert witness services for clients worldwide. Depending on the assignment, the firm’s technical specialists act as sole experts within a specialized technical team or collaborate with other experts in complementary disciplines such as quantum, delay, forensic accounting, and commercial damages, known as HKA’s multidisciplinary service.
The recent airstrike chat leak has brought renewed attention to the risks of digital communications, particularly the forensic traceability of messaging platforms. For attorneys handling litigation, investigations, or compliance matters, understanding how secure messaging apps store, retain, and expose data is essential, especially as encrypted communications become standard practice in corporate, legal, and governmental settings.
One of the most frequently discussed platforms is Signal, often regarded as the gold standard for private communication. While its end-to-end encryption and minimal metadata retention make it far more secure than alternatives like WhatsApp, Telegram, or Microsoft Teams, the notion that Signal leaves no forensic trace is a misconception. In legal and forensic contexts, the reality is more nuanced. If a full file system image is obtained using tools like Magnet Graykey™ or Magnet Verakey™, and the keychain is extracted, the Signal database can be decrypted, allowing access to active (non-disappearing) messages, calls, and attachments.
This article explores how Signal compares to other messaging platforms, what forensic artifacts can be recovered, and why legal teams should carefully assess how confidential communications are handled.
Messaging platforms and forensic considerations
Signal vs. other messaging platforms
Feature
Signal
WhatsApp
Telegram
Microsoft Teams
End-to-End Encryption (E2EE)
Always on
On by default
Optional (secret chats only)
Not on by default
Message Storage
Device-only (unless extracted with keychain)
Device & cloud backups
Device & cloud (non-secret chats)
Cloud-based, admin-controlled
Metadata Logging
Minimal (last online only)
Stores sender/receiver, timestamps
Stores sender/receiver, timestamps
Extensive logs, accessible to admins
Message Retention
Disappearing messages available
Cloud backups (if enabled)
Logs persist unless deleted
Retained by organization
Forensic Recoverability
Possible if full file system image & keychain obtained
Full chat logs retrievable
Partial chat logs retrievable
Full conversation history retrievable
Forensic recovery of Signal data: What is possible?
Despite Signal’s strong encryption and security features, forensic practitioners can decrypt its database under specific conditions:
With standard forensic extraction methods (logical, partial file system imaging)
Recoverable artifacts:
App installation logs
Last active timestamps
Push notification logs (temporary message previews may persist on Android)
Not recoverable:
Message content (remains encrypted)
Call history (not stored in standard call logs)
Contacts and chat history (never stored on Signal servers)
With full file system imaging (Magnet Graykey™, Magnet Verakey™) and keychain extraction
Decrypted artifacts:
Active (non-disappearing) messages
Call logs
Attachments (images, videos, files)
Contact information (names/numbers associated with chats)
Still not recoverable:
Disappearing messages (deleted at operating system level if expired before acquisition)
Cloud backups (Signal does not store these)
TAKEAWAY
While Signal minimizes forensic traces under normal conditions, if the full file system is imaged and the keychain is decrypted, the Signal database becomes accessible, making it as recoverable as other encrypted messaging apps for active messages.
Conclusion
Forensic recovery of Signal data: What is possible?
The leak of military airstrike discussions highlights operational security (OPSEC) failures and the risks of using messaging platforms that leave forensic footprints. Forensic recovery would have been significantly limited if these communications had taken place on Signal with disappearing messages enabled.
From a forensic standpoint, this case underscores:
✔ The importance of understanding keychain security: Without it, even encrypted messaging apps are vulnerable to forensic analysis.
✔ Why disappearing messages matter: Standard extractions can miss ephemeral data, but full file system images do not.
✔ The dangers of cloud backups: Most platforms allow cloud storage, which exposes conversations to remote access and subpoenas.
✔ Operational security failures: Poor messaging hygiene can compromise even encrypted conversations.
Key takeaways for forensic investigators
Signal is not immune to forensic recovery – with a full file system image and extracted keychain, investigators can decrypt messages, calls, and attachments.
Platforms like WhatsApp, Telegram, and Teams retain far more forensic evidence in cloud backups and accessible databases.
Disappearing messages remain the best countermeasure against forensic recovery – if they expired before the acquisition, they are effectively gone.
Investigators must educate clients on secure communication practices – understanding forensic limitations can enhance investigative techniques and OPSEC for high-risk users.
The airstrike chat leakwas preventable. Understanding the forensic recoverability of messaging apps is crucial – not just for forensic practitioners but for anyone handling classified, sensitive, or high-risk communications.
Contact
Please contact us if you would like to discuss secure communication analysis or forensic extraction techniques or visit our website for more information about our Digital Forensics and Data Solutions services.
About the authors
Michael Bandemer has more than 20 years of experience leading the preservation, forensic collection, analysis, and search of electronically stored information (ESI) and forensic artifacts in more than 1,000 matters ranging from corporate/federal investigations to commercial litigation. He has provided expert witness and strategic consulting services to law firms and corporate clients in the areas of computer forensics, investigations, electronic discovery, data analytics, and data privacy/data breaches.
Geo Brown has over 25 years of experience in information technology and more than 18 years of experience in digital forensic collection and analysis, data analytics, investigations, and electronic discovery. He has opined, directed, managed, and conducted in-depth analyses on hundreds of complex matters in various industries. Geo’s strategic guidance and comprehensive analysis have assisted clients in safeguarding their intellectual property, maintaining competitive advantages, and navigating intricate legal and business landscapes.
HKA expands its Digital Forensics and Data Solutions footprint with Partners Andy Antunez and Richard Peters
25th March 2025
HKA is pleased to announce that Andy Antunez and Richard Peters have joined HKA as Partners in its Digital Forensics and Data Solutions practice.
They bring in-depth experience in digital forensics, information technology, cybersecurity, and decentralized finance, bolstering our team’s ability to deliver expert insights and solutions in the expansive realm of digital evidence.
Andy Antunez, Partner
With over 20 years of expertise in digital forensics, security, and information technology (IT), Andy Antunez brings a wealth of professional experience to the HKA team. His background includes leading investigations related to digital forensic collections, data destruction and manipulation, employment issues, fraud, and insider risk.
Andy has practical, hands-on training and expertise in providing forensic technology services, including data preservation, digital forensics, electronic discovery, and data analysis. Over the past two decades, he has personally imaged over 10,000 computer devices and over 5,000 mobile devices, serving as a computer forensics examiner, expert, neutral, or litigation consultant on more than 500 matters.
“I’m looking forward to bringing my experience leading complex investigations, conducting in-depth forensic analysis, and examining electronically stored information to HKA. The expertise I’ve developed has prepared me to contribute meaningful and effective solutions for our clients facing digital and data challenges.”
Andy Antunez, Partner
Andy specializes in data exfiltration, unauthorized data access, intellectual property theft, and misappropriation of trade secrets. He has provided expert witness testimony in federal and state courts and arbitrations in multiple jurisdictions on over 40 occasions.
Andy is a licensed private investigator in the State of Texas. He holds a Master of Business Administration in Information Technology Management from the University of Dallas and a Bachelor of Science in Computer Information Systems from West Texas A&M University. He is an EnCase and AccessData Certified Examiner and is Cellebrite UFED Touch and UFED Physical Certified.
Richard Peters has over 25 years of experience as a senior information security advisor specializing in cybersecurity, crypto tracing, cryptocurrency, digital forensics, investigations, and compliance. He has managed and delivered IT security solutions, including technology risk management services, audits, security assessments, compliance assessments, attack-and-penetration testing, and security analysis.
He has designed, assessed, and tested security standards and frameworks, the International Organization for Standardization (ISO) 27001/27002, the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the National Institute of Standards and Technology (NIST CSF and 800 series).
Richard has specific experience with penetration testing for applications, networks, and hardware. He has used this skillset for forensic and security assessments in cryptocurrency, blockchain investigations, crypto asset tracing, and the decentralized finance space.
“I am excited to bring my cybersecurity and information technology expertise to our Digital Forensics and Data Solutions team. In a landscape where digital threats constantly evolve, I look forward to delivering innovative solutions, strengthening risk mitigation strategies, and ensuring our clients’ digital assets remain secure and resilient.”
Richard Peters, Partner
His experience and knowledge encompass client and server environments, mainframes, databases, applications, and hardware. Richard has provided expert witness testimony on numerous occasions for matters related to cybersecurity, crypto investigations, and fraud.
Richard holds a Bachelor of Business Administration in Finance from the University of Texas at Austin, as well as several licenses and certifications related to cybersecurity, cryptocurrency, and IT, including TRM Crypto Compliance Specialist, TRM Advanced Crypto Investigator, TRM Digital Forensics and Cryptocurrencies, TRM Certified Investigator, TRM Crypto Fundamentals Certification, Cryptocurrency Tracing Certified Examiner, Certified Data Privacy Solutions Engineer, Certified Information Systems Auditor, Qualified Security Assessor, and Certified Information Systems Security Professional.
“We are thrilled to welcome Andy and Richard to our Digital Forensics and Data Solutions team. With their extensive experience in information security, data analysis, and risk management, they will be instrumental in enhancing our ability to help clients navigate the ever-evolving digital landscape with confidence and precision.”
Michael Bandemer, Partner, Head of Digital Forensics and Data Solutions
HKA’s Digital Forensics and Data Solutions professionals specialize in the collection, analysis, investigation, discovery, tracing, and governance of digital data.The team has extensive experience delivering expert insights into the expansive realm of digital evidence. They excel at supporting organizations, law firms, and government agencies as they navigate the complexities of digital investigations, including eDiscovery, advanced analytics, high-tech crime, blockchain forensics, and cybersecurity. HKA’s services also address data privacy, governance, and compliance, providing reliable, actionable findings to meet litigation, regulatory, and security challenges.
In these times of changing priorities within the U.S. federal government, it is crucial for contractors to understand the immediate actions they can take to ensure maximum cost recovery and protect their interests in the event of work stoppages or terminations.
Stop work v. suspension of work
Federal Acquisition Regulation (FAR) 42 outlines the applicability of clauses related to stop-work orders and suspension of work to negotiated contracts. Should either of these clauses be used as a basis to stop work, it is essential to evaluate the particulars of the invoked clause to fully understand contractor obligations and rights. FAR 52.242-15 (Stop-Work Order) and FAR 52.242-14 (Suspension of Work) contain not only similar provisions but also key differences related to required timeframes for action and recoverability of profit, among others. It is important to note that a work stoppage does not necessarily mean the contract will be terminated.
If your work is stopped or suspended, what should you do?
Comply with the requirements of the notice (e.g., provide immediate notification to subcontractors to stop work).
Coordinate with affected subcontractors (it is the prime or upper-tier subcontractor’s responsibility to do this, not the government’s).
Establish separate charge codes within your accounting system to record costs associated with a work stoppage. Capturing these costs contemporaneously is a best practice and helps avoid a “re-accounting” of costs to support requests for equitable adjustment.
Establish a process to monitor schedule delays and evaluate whether schedule impacts go beyond the time period during which work was stopped or suspended (e.g., due to pushing restarted work into seasons with weather conditions that would create further delays beyond the period of work stoppage).
Contract termination
FAR 49, which contains provisions for contract terminations applicable to negotiated contracts, is voluminous and includes a wide array of topics, including contractor obligations when receiving a termination notice, settlement of subcontractor proposals, partial and final payment, inventory disposition, and the actual forms used for termination settlement proposals, among many others.
A host of contract clauses cover contract terminations specific to particular contract types (e.g., FAR 52.249-2 applies to fixed-price contracts), each containing unique provisions. In addition, FAR 31, which is the basis for negotiating costs under a terminated contract, includes a cost principle for termination costs (i.e., FAR 31.205-42) detailing requirements applicable to common costs that can arise in contract termination.
If your work is terminated, some recommended steps are similar to those in a work stoppage, including terminating subcontractors, establishing separate charge codes for termination activities, and ensuring compliance with actions stipulated in the termination notice. That being said, contract termination is far broader in scope than a work stoppage, and time should be taken to understand all contractor obligations spelled out in FAR 49 and the termination clause applicable to your contract. Termination settlement proposals must normally be submitted within one year of the date the termination notice was received, so acting quickly to satisfy termination obligations is advisable.
If you encounter a work stoppage or your contract is terminated, please click here for more information about our Government Contracting and Compliance Expert Services practice or contact an HKA Government Contracting expert for assistance at inquires@hka.com.
About the author
Mike LaCorte has more than 18 years of experience in government contracts, accounting, auditing, and management consulting. Mike has led various consulting engagements, including regulatory compliance and business system assessments, investigations and litigation support, cost and damage analyses, organizational restructurings, bid protests, due diligence related to mergers and acquisitions, management consulting, and other similar assignments. Mike is deeply familiar with the requirements of the Federal Acquisition Regulation (FAR), FAR Supplements (e.g., the Defense FAR Supplement (DFARS)), the Office of Management and Budget (OMB) Uniform Guidance, Cost Accounting Standards (CAS), and generally accepted accounting principles (GAAP).
HKA expands its Government Contracting and Compliance practice with the addition of Director José Soto
8th January 2025
HKA is pleased to welcome Director José Soto to its Government Contracting and Compliance team in Washington, DC.
José is a compliance and subject matter expert with almost 25 years of experience in government contracting across various industries. His expertise encompasses extensive knowledge of government rules and regulations, including the Federal Acquisition Regulation (FAR), the Defense Federal Acquisition Regulation Supplement (DFARS), and Cost Accounting Standards (CAS).
José guides clients through cost and pricing strategies and transformation initiatives. He prepares and analyzes cost impact proposals, gross dollar magnitude, disclosure statements, incurred cost submissions, and forward pricing rate proposals. José also supports clients with large enterprise resourcing planning (ERP) systems such as Deltek Costpoint, Oracle NetSuite, and SAP.
Earlier in his career, José spent over six years as a senior auditor at the Defense Contract Audit Agency (DCAA) and is well-versed in DCAA requirements. His subsequent experience includes working in various compliance roles for some of the federal government’s largest contractors.
“We are thrilled to welcome José to our team. His years of experience and expertise with government contract compliance issues make him a valuable addition to HKA. We’re confident that his skills and experience will significantly enhance our capacity to support clients and lead to innovative contributions.”
Jamie Sybert, Partner
Before joining HKA, José was a director at MorganFranklin Consulting, where he was instrumental in building its Government Contracting Advisory practice. He has a Bachelor of Arts in Accounting from the University of Puerto Rico and is fully fluent in Spanish.
HKA has a successful track record advising government contractors and their counsel on aerospace and defense, technology, media and telecoms, life sciences and healthcare, and professional services matters.
HKA helps clients handle complex issues related to requests for equitable adjustment, certified claims, contracting officer’s final decision appeals, prime contractor and subcontractor disputes, termination settlement proposals, bid protest assistance, bribery and anti-corruption, compliance and risk management, investigations, and grants and agreements.
The firm’s Government Contracting and Compliance team members provide expert witness testimony at the U.S. Court of Federal Claims, the Armed Services Board of Contract Appeals, the Civilian Board of Contract Appeals, and other state and federal courts.
Michael Griffin named a Fellow of the Construction Management Association of America
26th November 2024
HKA is proud to announce that the Construction Management Association of America (CMAA) has named Partner Michael Griffin to its prestigious College of Fellows.
The CMAA, an organization dedicated to advancing and supporting professional construction management and program management development, focuses on building the workforce of the future for the continued growth of the construction industry. Its mission includes the development of research beneficial to the advancement of technological, educational, and vocational expertise in the industry, and education in the construction management profession.
Each year, the CMAA designates certain members to the College of Fellows. Fellows are selected in recognition of their leadership in the construction and program management profession, their contributions to the profession’s enduring development, and their support and commitment to the CMAA. It is the highest honor that can be bestowed on a CMAA member.
“It is a tremendous honor to be selected as a Fellow. The CMAA’s leadership and dedication to excellence have been pivotal in the construction management field, setting the standards that drive quality and innovation. I am incredibly proud to be part of CMAA’s eminently qualified Fellows and am committed to fostering the growth of the construction management profession.”
Michael Griffin, Partner, Forensic Technical Services Lead, Americas
“This achievement not only highlights Mike’s dedication and expertise but also reflects the high caliber of excellence at HKA. I am incredibly grateful to Mike for his outstanding leadership of our Forensic Engineering, Architectural, and Technical Expert Services practice here in the Americas. We are honored to have him on our team, and we are excited to see how his contributions will continue to shape the future of the construction industry.”
Frank Giunta, Partner, Regional CEO, Americas
Michael, a civil engineer with more than 45 years of construction industry experience, leads HKA’s Forensic Engineering, Architectural, and Technical Expert Services practice in the Americas. He has acted as an expert witness in government contracting and technical matters and has testified in federal and state courts.
With an extensive background as a project manager, construction manager, and principal in charge of multi-million-dollar projects across North America, his expertise includes assessing contractors’ and construction managers’ performance and standard of care, evaluating defective construction, calculating damages, and conducting contract analysis and administration.
View Michael Griffin’s expert profile here and discover more about the firm’s experts by visiting our extensive Expert Centre.
HKA’s forensic engineering, architectural, and technical experts provide expert advisory, expert determination, and expert witness services for clients worldwide. Depending on the assignment, the firm’s technical specialists act as sole experts within a specialized technical team or collaborate with other experts in complementary disciplines such as quantum, delay, forensic accounting, and commercial damages, known as HKA’s multidisciplinary service.
HKA Director Alex Mats honored with the American Institute of CPAs’ Standing Ovation Award
20th November 2024
HKA is pleased to announce that the American Institute of Certified Professional Accountants (AICPA) has recently recognized Alex Mats, Director of Forensic Accounting and Commercial Damages (FACD), with its prestigious Standing Ovation Award. This honor highlights Alex’s exceptional contributions and dedication to the profession.
The AICPA is dedicated to providing exclusive guidance and specialized resources, including esteemed designations, certifications, and credentials, to accounting and finance professionals. The annual Standing Ovation Award recognizes young financial professionals who exhibit exemplary achievement in the areas of forensic accounting and business valuation. Alex is among 12 award recipients honored at the 2024 AICPA and CIMA Forensic and Valuation Services Conference held in Dallas this past October.
“I am deeply honored to receive the AICPA Standing Ovation Award, which is not only a personal milestone but also an acknowledgment of the benchmark of excellence of my work at HKA. This field requires us to constantly adapt, innovate, and uphold the highest standards of integrity, and I am grateful to be part of a profession that challenges me to grow every day.”
Alex Mats, Director
“The Standing Ovation Award reflects the hard work, dedication, and passion that Alex always brings to HKA’s FACD team. We are grateful to the AICPA for honoring his contributions and are excited to see his future impact on the forensic accounting industry.”
Dave Duffus, Partner
Alex has experience in public accounting, corporate accounting, and litigation support. At HKA, he consults on a variety of financial, economic, and accounting matters, including complex financial disputes related to commercial litigation, forensic accounting, and business valuation. Alex has authored expert reports and testified as an expert at deposition and trial and in alternative dispute settings.
Please visit our Expert Centre to find out more about Alex Mats and our other HKA experts. For more information about the AICPA, please click here.
HKA’s FACD experts have extensive experience advising clients on the accounting, economic, and financial impacts of complex matters. The firm’s experts serve clients by analyzing issues related to various disputes, including breach of contract, intellectual property, shareholder, mergers, and acquisitions. Additionally, HKA undertakes fraud, forensic, and regulatory investigations.
Dr. Muaz Fagiar joins HKA Americas’ Construction Claims Group based in Canada
8th November 2024
HKA welcomes Dr. Muaz Fagiar to its Calgary construction claims management team in Canada.
Dr. Fagiar joins HKA as a Director with over 15 years of experience specializing in contract and claims management, project controls, and dispute resolution. He is a subject matter expert in critical path method scheduling, delay and disruption analysis, and claims management, mitigation, and avoidance.
Dr. Fagiar assists clients with identifying risks, implementing controls, minimizing claims exposure, and establishing contract and claims management strategies. He has worked on several major infrastructure projects in Western Canada, such as the Valley Line LRT. His expertise spans transportation systems, roads, tunnels, bridges, dams, utilities, facilities, and signaling systems, among other areas.
“Dr. Fagiar brings a unique blend of expertise and innovative perspectives to HKA, making him an invaluable asset in the construction industry. His experience implementing advanced methodologies for effective claims management and dispute resolution is crucial to helping us grow our team in Canada. We look forward to working with him to deliver increased value and exceptional service to our clients.”
John Baxter, Partner
Dr. Fagiar has authored, co-authored, and presented numerous papers at conferences, published papers in construction management journals, and delivered guest lectures on contracts and claims management.
He holds a Doctor of Philosophy in Construction Engineering and Management from the University of Alberta, a Master of Science in Engineering Project Management from Teesside University, and a Bachelor of Engineering in Civil Engineering from Sudan University of Science and Technology.
HKA’s claims and dispute resolution experts investigate the causes and effects of events, analyze contractual entitlement and causation, and quantify the effects in pursuing or defending claims. The firm’s experts address claims issues related to extensions of time, prolongation, disruption, acceleration, loss and expense, changes in legislation, and variations. HKA’s commercial and contract managers, quantity surveyors, cost engineers, planners and schedulers, and technical engineering specialists support clients at any stage of a project’s life cycle.
