In today's tech-centric world, the majority of our actions center around technology—sitting in front of computers at work, navigating traffic with mobile GPS systems or monitoring our heart rates through wearable devices, to name a few. While there are clear benefits to the endless uses of technology, few people realize all the data that exists on these devices.

What's more, many don't realize how that data can be forensically collected and used to prove innocence or guilt in legal matters, making it extremely valuable to attorneys. Here are three types of data most people don't realize exist, yet could be crucial in litigation:

|

iPhone Location Settings

Most people are aware that myriad smartphone apps are always tracking your location unless you adjust the settings. However, there's another level of tracking that is not commonly known —and the feature is set to "on" by default. Ever wonder how your phone knows which time zone you're in? The phone itself is constantly tracking your location in the background, most of the time without your knowledge. See for yourself by going to Settings → Privacy → Location Services → System Services.

System processes like "Find My iPhone," Apple Pay and even location-based ads are part of why iPhones are unique, often providing the information you need before you even realize you need it. For example, when I get in my car in the mornings, my phone tells me how long it will take to get to work. However, this location data could also be used as incriminating or exculpatory evidence.

After making a forensic image of the phone, forensics professionals can mine a device's location history and present the data in litigation – to prove either innocence by providing an alibi, or guilt by putting the device in a questionable place at a specific time. In fact, you can see this data for yourself—within System Services, tap Significant Locations to see a list of the places you have often visited since purchasing your iPhone.

|

Androids and Gmail

Androids collect the same location data too, of course, and because operating an Android phone requires a Gmail account, all that information and more is going back to Google. According to CNBC, there are more than 1.5 billion active Gmail accounts in the world—making up nearly 40 percent of the 3.8 billion email users worldwide. Google also collects user activity through its browser Chrome and Google Maps—and it's all tied to those Gmail accounts.

Google currently has more than 50 different categories of user data it's collecting, including:

  • Web searches and website viewing history
  • What you've watched on YouTube
  • Location history
  • Shopping information
  • Health activity data collected from connected fitness devices
  • Audio of commands recorded on Android-based smart home devices

To see the activity stored on your Android device, open Settings → Google → Google Account → Data & Personalization → Activity & Timeline → My Activity.

|

Websites

Every time you sign up for a new website, you agree to its privacy policy, whether you take the time to fully read it or not. Many users might not realize that deleting an account on some social media platforms, such as Facebook and Twitter, first requires a deactivation period. These two popular platforms have a 30-day deletion policy, in which an account and all its information is stored for 30 days before it is completely expunged. That means a person could delete an account in an attempt to hide incriminating evidence, so it's important to act quickly to preserve content found on social media.

Social media content is becoming more and more useful in litigation today, but is often time-sensitive, and should be preserved as soon as litigation is anticipated. If information is deleted, it is much more difficult to recover, especially as more time passes. It may require a court request or subpoena to retrieve deleted posts, if even possible. But, even if unrecoverable, that deletion action alone could be used against the actor, and could lead to a court victory by itself if the destroyed data is substantial enough to the claims in the case. It's important to be aware of any website that could hold incriminating evidence and its privacy policy so you can use the data during litigation.

|

Tips for Attorneys

Without the assistance of forensics professionals, it can be difficult to understand exactly what data can be tracked and how it can be used. Here are four tips for attorneys working cases involving digital evidence (which, these days, is nearly every case):

1. Assume the data can be forensically collected: If you have an account that is connected to the internet, some type of information is most likely being tracked. The data may be stored on a device or transferred to the cloud, but don't presume the technology and all its data is irretrievable without considering what evidence it may hold. Even devices such as video doorbells or gaming consoles (such as Xbox or PlayStation) can store user activity, so be sure to consult a forensics professional about the data sources relevant to your case to see if you can mine them for evidence.

2. Act with urgency: While most of this data can be collected, there may be time restraints to consider. The minute you're aware of any digital evidence, it's important to issue a legal hold to avoid deletion, even if it's accidental. Depending on the user's settings, the device may only retain certain data for a specific period and overwrite itself as time goes by. For example, a user can elect to save text messages for only 30 days and then self-delete after the time period ends. Some text messaging apps allow irrecoverable deletion in much shorter time frames as specified and controlled solely by the user. If a legal team discovers that text messages sent more than 30 days ago are relevant to their case, there's no way to retrieve that data (unless the messages are still stored on the recipient's phone).

3. Just because it's not possible now doesn't mean it won't be in the future: Technology is continuously evolving, which means digital forensics is, too. There are new devices that track users' activity coming on the market weekly. Consider fitness devices, which were just popping up about 10 years ago. They track users' location, activity level and health information, which is why these devices are used as supporting evidence or to refute witness testimonies—something we wouldn't have even dreamed of in the early 2000s. The good news is that forensic investigative tools are continuously improving too. Every year, we have more capacity and options than the year before, and there's no telling what our capabilities will be in the future.

4. Consult a forensic professional: It's wise to confer with a licensed forensic expert to discuss your case and identify all possible locations relevant data could be stored. Everyone is aware of the common devices, such as computers and mobile phones, but forensic investigators are also mindful of many other areas that could potentially contain evidence. They can also collect the data in a way that maintains its integrity and captures all the metadata. Experts in other technology sectors are not necessarily familiar with evidence preservation techniques and do not use the same tools and procedures to ensure the data is defensibly collected, possibly rendering it unusable in legal matters.

These days, most evidence in litigation is digital, but appearing in court without all the relevant data is like appearing without the whole story. Consider these alternate sources—like where the person in question was, what time, how long and more. In the end, the data you didn't even know existed might just be the evidence needed to prove your case.

 

 

Wes Johnson is the senior digital forensic examiner at eDiscovery and digital forensics company BIA. He has more than 20 years of experience in forensically retrieving and analyzing computer evidence and providing litigation support. He has analyzed and presented evidence in cases involving theft of intellectual property, theft of trade secrets, fraud, breach of contract, Securities and Exchange Commision investigations, spoliation and destruction of evidence.