John R. Troxel
Computer Forensics Expert · Digital Evidence Investigator · Expert Witness
John R. Troxel is a computer forensics expert and licensed private investigator with nearly three decades of investigative experience. Since 1997 he has been a trusted resource to leading law firms, corporations, and family offices — recovering digital evidence, conducting complex investigations, and providing expert-witness testimony on the collection, preservation, and analysis of electronically stored information (ESI). He leads a team of forensic analysts whose expertise spans cyber security, IT, and incident response.
Contact us for a case consultation →The Narrative
John has built a career on a simple, stubborn skill: finding what people have gone to great lengths to hide.
His assignments have taken him around the globe, working complex matters for corporations and law firms — and the through-line has always been the same. Whether the evidence lives on a hard drive, a cell phone, a cloud backup, or in a paper trail that runs back to the 1800s, the job is to extract what's pertinent and make it hold up. He pairs forensic analysis of digital media with old-fashioned investigative work — obtaining critical intelligence and identifying key witnesses — to support litigation from start to finish.
There's a reason the historical and land-use investigations recur in his casework. John holds a B.S. in Geographic Information Systems from the University of Utah, and that training in mapping, records, and spatial history shows up in the work — like the hundred-year land-use investigation that traced contamination on a city's tenement-housing site back to a small oil refinery that operated from 1895 to 1920, then followed the liability through a century of mergers to the multinational that owns it today.
He is also a sought-after speaker, regularly invited to share his insights on digital evidence found on computers, cell phones, and cloud storage systems.
Today John leads a team of forensic analysts whose expertise spans cyber security, IT, and incident response — depth that lets the firm move from a single-device extraction to a full breach investigation without handing the matter off. When a case needs more than one discipline at the table, it already has them.
John splits his time between California and Utah, serving clients from both. He's active in his church, follows Utah football, and spends as much time as he can with his grandkids.
Expert Witness & Court Experience
John provides expert-witness testimony on digital forensic matters, from the collection of ESI through analysis to the stand. Every case is handled as if it is headed for litigation — because the discipline that makes evidence defensible can't be added after the fact. His areas of testimony and analysis include digital evidence from mobile devices, computers, and cloud storage.
Certifications & Credentials
- AccessData Certified Examiner
- California Private Investigator License #22186
- Professional Certificate in Computer Forensics — Oregon State University, 2003
- B.S., Geographic Information Systems — University of Utah, 1993
- 500+ hours of specialized forensic training — AccessData, NTI/Armour, the Association of Certified Fraud Examiners Academy, the High Technology Crime Investigation Association, Paraben Forensics, and Techno Security
Professional Associations: High Technology Crime Investigation Association · Professional Investigators of California
Areas of Focus
Computer & Digital Forensics
Collection of ESI through analysis and expert-witness testimony, with deep expertise in the digital analysis of mobile devices, computers, and cloud storage.
Due Diligence Background Investigations
Identifying potential risk when vetting candidates for C-suite roles and board appointments, and for pre-investment diligence in private equity, venture capital, and M&A.
Additional Services
Asset investigations · TSCM surveys (bug sweeps) · Surveillance · Locating people · Witness development · Historical research
Representative Engagements
A sampling of matters — anonymized — that show the range:
- Outgoing president, data destruction. For an Irvine manufacturer, identified the destruction of data by a departing president before he launched a competing company.
- Hidden assets in a divorce. Discovered roughly $2 million in previously unknown brokerage accounts on the computer of a client's spouse in a Thousand Oaks family-law matter.
- Custody case, illegal images. For a Los Angeles law firm, identified illegal images on the hard drive of a client's former spouse in a custody dispute.
- Public-corruption investigation. Retained as outside investigator by a California county to identify inappropriate and illegal activity by the District Attorney, resulting in his separation from office.
- Proprietary technology misuse. For a San Francisco manufacturer, identified a customer's improper use of proprietary technology in a medical facility.
- Hundred-year land-use history. Traced a city's contamination liability across a century of corporate succession (see narrative above).
- $1.5M environmental resolution. For a Ventura law firm, reconstructed the history of a county facility that leaked fuel and chemicals — interviewing witnesses going back to the 1940s and researching historical maps and records — supporting a recovery of over $1.5 million.
Clients Served
Over his career John has served leading national law firms and major corporations, including firms such as Lewis Brisbois, Gibson Dunn, Latham & Watkins, Kirkland & Ellis, Morrison & Foerster, and Greenberg Traurig, and organizations including Cisco Systems, Northrop Grumman, and Raytheon.
In Their Words
"I cannot remember working with any investigator — for that matter, any outside vendor — whose professionalism exceeded yours." — Alan R. Maler, Esq., Greenberg Traurig
"Handled a recent research project for the City with skill, reliability, and service… a breath of fresh air." — Curt Holguin, Esq., Deputy City Attorney, City of Los Angeles
Work With John
Whether your matter involves digital evidence on a phone or computer, hidden assets, pre-investment diligence, or an investigation that needs both forensic rigor and real investigative instinct, John and the VRI / Risk Control Strategies team are ready to help.
Contact us for a case consultation →
Frequently Asked Questions
What are John Troxel's qualifications as a computer forensics expert?
John is an AccessData Certified Examiner and a licensed California private investigator (#22186) with nearly three decades of investigative experience. He holds a Professional Certificate in Computer Forensics from Oregon State University and a B.S. in Geographic Information Systems from the University of Utah, plus 500+ hours of specialized forensic training.
Does John Troxel provide expert-witness testimony?
Yes. John provides expert testimony on digital forensic matters, covering the collection, preservation, and analysis of electronically stored information from computers, mobile devices, and cloud storage.
What types of cases does John handle?
Computer and cell phone forensics, due-diligence background investigations, asset investigations, and litigation support — with extensive experience in employment and family-law matters for law firms, corporations, and family offices.
Does John work alone or with a team?
John leads a team of forensic analysts whose expertise spans cyber security, IT, and incident response, allowing the firm to handle everything from a single-device forensic extraction to a full incident-response and breach investigation.
Where is John Troxel based?
John splits his time between California and Utah, serving clients from both locations and traveling nationwide as matters require.