<\/p>\n
![\"\"](\"https:\/\/images.law.com\/contrib\/content\/uploads\/sites\/397\/2019\/01\/Mobile-Phone-Texting-Article-201901232022.jpg\")
<\/p>\n
\u00a0<\/p>\n
In today\u2019s tech-centric world, the majority of our actions center around technology\u2014sitting in front of computers at work, navigating traffic with mobile GPS systems or monitoring our heart rates through wearable devices, to name a few. While there are clear benefits to the endless uses of technology, few people realize all the data that exists on these devices.<\/p>\n
What\u2019s more, many don\u2019t realize how that data can be forensically collected and used to prove innocence or guilt in legal matters, making it extremely valuable to attorneys. Here are three types of data most people don\u2019t realize exist, yet could be crucial in litigation:<\/p>\n
iPhone Location Settings<\/strong><\/h2>\nMost people are aware that myriad smartphone apps are always tracking your location unless you adjust the settings. However, there\u2019s another level of tracking that is not commonly known \u2014and the feature is set to \u201con\u201d by default. Ever wonder how your phone knows which time zone you\u2019re in? The phone itself is constantly tracking your location in the background, most of the time without your knowledge. See for yourself by going to Settings \u2192 Privacy \u2192 Location Services \u2192 System Services.<\/p>\n
System processes like \u201cFind My iPhone,\u201d Apple Pay and even location-based ads are part of why iPhones are unique, often providing the information you need before you even realize you need it. For example, when I get in my car in the mornings, my phone tells me how long it will take to get to work. However, this location data could also be used as incriminating or exculpatory evidence.<\/p>\n
After making a forensic image of the phone, forensics professionals can mine a device\u2019s location history and present the data in litigation \u2013 to prove either innocence by providing an alibi, or guilt by putting the device in a questionable place at a specific time. In fact, you can see this data for yourself\u2014within System Services, tap Significant Locations to see a list of the places you have often visited since purchasing your iPhone.<\/p>\n
Androids and Gmail <\/strong><\/h2>\nAndroids collect the same location data too, of course, and because operating an Android phone requires a Gmail account, all that information and more is going back to Google. According to CNBC<\/a>, there are more than 1.5 billion active Gmail accounts in the world\u2014making up nearly 40 percent of the 3.8 billion email users<\/a> worldwide. Google also collects user activity through its browser Chrome and Google Maps\u2014and it\u2019s all tied to those Gmail accounts.<\/p>\nGoogle currently has more than 50 different categories of user data it\u2019s collecting, including:<\/p>\n
\n- Web searches and website viewing history<\/li>\n
- What you\u2019ve watched on YouTube<\/li>\n
- Location history<\/li>\n
- Shopping information<\/li>\n
- Health activity data collected from connected fitness devices<\/li>\n
- Audio of commands recorded on Android-based smart home devices<\/li>\n<\/ul>\n
To see the activity stored on your Android device, open Settings \u2192 Google \u2192 Google Account \u2192 Data & Personalization \u2192 Activity & Timeline \u2192 My Activity.<\/p>\n
Websites<\/strong><\/h2>\nEvery time you sign up for a new website, you agree to its privacy policy, whether you take the time to fully read it or not. Many users might not realize that deleting an account on some social media platforms, such as Facebook and Twitter, first requires a deactivation period. These two popular platforms have a 30-day deletion policy, in which an account and all its information is stored for 30 days before it is completely expunged. That means a person could delete an account in an attempt to hide incriminating evidence, so it\u2019s important to act quickly to preserve content found on social media.<\/p>\n
Social media content<\/a> is becoming more and more useful in litigation today, but is often time-sensitive, and should be preserved as soon as litigation is anticipated. If information is deleted, it is much more difficult to recover, especially as more time passes. It may require a court request or subpoena to retrieve deleted posts, if even possible. But, even if unrecoverable, that deletion action alone could be used against the actor, and could lead to a court victory by itself if the destroyed data is substantial enough to the claims in the case. It\u2019s important to be aware of any website that could hold incriminating evidence and its privacy policy so you can use the data during litigation.<\/p>\nTips for Attorneys <\/strong><\/h2>\nWithout the assistance of forensics professionals, it can be difficult to understand exactly what data can be tracked and how it can be used. Here are four tips for attorneys working cases involving digital evidence (which, these days, is nearly every case):<\/p>\n
1. Assume the data can be forensically collected: <\/strong>If you have an account that is connected to the internet, some type of information is most likely being tracked. The data may be stored on a device or transferred to the cloud, but don\u2019t presume the technology and all its data is irretrievable without considering what evidence it may hold. Even devices such as video doorbells or gaming consoles (such as Xbox or PlayStation) can store user activity, so be sure to consult a forensics professional about the data sources relevant to your case to see if you can mine them for evidence.<\/p>\n2. Act with urgency: <\/strong>While most of this data can be collected, there may be time restraints to consider. The minute you\u2019re aware of any digital evidence, it\u2019s important to issue a legal hold to avoid deletion, even if it\u2019s accidental. Depending on the user\u2019s settings, the device may only retain certain data for a specific period and overwrite itself as time goes by. For example, a user can elect to save text messages for only 30 days and then self-delete after the time period ends. Some text messaging apps allow irrecoverable deletion in much shorter time frames as specified and controlled solely by the user. If a legal team discovers that text messages sent more than 30 days ago are relevant to their case, there\u2019s no way to retrieve that data (unless the messages are still stored on the recipient\u2019s phone).<\/p>\n3. Just because it\u2019s not possible now doesn\u2019t mean it won\u2019t be in the future:<\/strong> Technology is continuously evolving, which means digital forensics is, too. There are new devices that track users\u2019 activity coming on the market weekly. Consider fitness devices, which were just popping up about 10 years ago. They track users\u2019 location, activity level and health information, which is why these devices are used as supporting evidence or to refute witness testimonies\u2014something we wouldn\u2019t have even dreamed of in the early 2000s. The good news is that forensic investigative tools are continuously improving too. Every year, we have more capacity and options than the year before, and there\u2019s no telling what our capabilities will be in the future.<\/p>\n4. Consult a forensic professional: <\/strong>It\u2019s wise to confer with a licensed forensic expert to discuss your case and identify all possible locations relevant data could be stored. Everyone is aware of the common devices, such as computers and mobile phones, but forensic investigators are also mindful of many other areas that could potentially contain evidence. They can also collect the data in a way that maintains its integrity and captures all the metadata. Experts in other technology sectors are not necessarily familiar with evidence preservation techniques and do not use the same tools and procedures to ensure the data is defensibly collected, possibly rendering it unusable in legal matters.<\/p>\nThese days, most evidence in litigation is digital, but appearing in court without all the relevant data is like appearing without the whole story. Consider these alternate sources\u2014like where the person in question was, what time, how long and more. In the end, the data you didn\u2019t even know existed might just be the evidence needed to prove your case.<\/p>\n
\u00a0<\/em><\/p>\n\u00a0<\/em><\/p>\nWes Johnson is the senior digital forensic examiner at eDiscovery and digital forensics company <\/em>BIA<\/em><\/a>. He has more than 20 years of experience in forensically retrieving and analyzing computer evidence and providing litigation support. He has analyzed and presented evidence in cases involving theft of intellectual property, theft of trade secrets, fraud, breach of contract, Securities and Exchange Commision investigations, spoliation and destruction of evidence. <\/em><\/p>\n<\/p><\/div>\n
Androids collect the same location data too, of course, and because operating an Android phone requires a Gmail account, all that information and more is going back to Google. According to CNBC<\/a>, there are more than 1.5 billion active Gmail accounts in the world\u2014making up nearly 40 percent of the 3.8 billion email users<\/a> worldwide. Google also collects user activity through its browser Chrome and Google Maps\u2014and it\u2019s all tied to those Gmail accounts.<\/p>\n Google currently has more than 50 different categories of user data it\u2019s collecting, including:<\/p>\n To see the activity stored on your Android device, open Settings \u2192 Google \u2192 Google Account \u2192 Data & Personalization \u2192 Activity & Timeline \u2192 My Activity.<\/p>\n Every time you sign up for a new website, you agree to its privacy policy, whether you take the time to fully read it or not. Many users might not realize that deleting an account on some social media platforms, such as Facebook and Twitter, first requires a deactivation period. These two popular platforms have a 30-day deletion policy, in which an account and all its information is stored for 30 days before it is completely expunged. That means a person could delete an account in an attempt to hide incriminating evidence, so it\u2019s important to act quickly to preserve content found on social media.<\/p>\n Social media content<\/a> is becoming more and more useful in litigation today, but is often time-sensitive, and should be preserved as soon as litigation is anticipated. If information is deleted, it is much more difficult to recover, especially as more time passes. It may require a court request or subpoena to retrieve deleted posts, if even possible. But, even if unrecoverable, that deletion action alone could be used against the actor, and could lead to a court victory by itself if the destroyed data is substantial enough to the claims in the case. It\u2019s important to be aware of any website that could hold incriminating evidence and its privacy policy so you can use the data during litigation.<\/p>\n Without the assistance of forensics professionals, it can be difficult to understand exactly what data can be tracked and how it can be used. Here are four tips for attorneys working cases involving digital evidence (which, these days, is nearly every case):<\/p>\n 1. Assume the data can be forensically collected: <\/strong>If you have an account that is connected to the internet, some type of information is most likely being tracked. The data may be stored on a device or transferred to the cloud, but don\u2019t presume the technology and all its data is irretrievable without considering what evidence it may hold. Even devices such as video doorbells or gaming consoles (such as Xbox or PlayStation) can store user activity, so be sure to consult a forensics professional about the data sources relevant to your case to see if you can mine them for evidence.<\/p>\n 2. Act with urgency: <\/strong>While most of this data can be collected, there may be time restraints to consider. The minute you\u2019re aware of any digital evidence, it\u2019s important to issue a legal hold to avoid deletion, even if it\u2019s accidental. Depending on the user\u2019s settings, the device may only retain certain data for a specific period and overwrite itself as time goes by. For example, a user can elect to save text messages for only 30 days and then self-delete after the time period ends. Some text messaging apps allow irrecoverable deletion in much shorter time frames as specified and controlled solely by the user. If a legal team discovers that text messages sent more than 30 days ago are relevant to their case, there\u2019s no way to retrieve that data (unless the messages are still stored on the recipient\u2019s phone).<\/p>\n 3. Just because it\u2019s not possible now doesn\u2019t mean it won\u2019t be in the future:<\/strong> Technology is continuously evolving, which means digital forensics is, too. There are new devices that track users\u2019 activity coming on the market weekly. Consider fitness devices, which were just popping up about 10 years ago. They track users\u2019 location, activity level and health information, which is why these devices are used as supporting evidence or to refute witness testimonies\u2014something we wouldn\u2019t have even dreamed of in the early 2000s. The good news is that forensic investigative tools are continuously improving too. Every year, we have more capacity and options than the year before, and there\u2019s no telling what our capabilities will be in the future.<\/p>\n 4. Consult a forensic professional: <\/strong>It\u2019s wise to confer with a licensed forensic expert to discuss your case and identify all possible locations relevant data could be stored. Everyone is aware of the common devices, such as computers and mobile phones, but forensic investigators are also mindful of many other areas that could potentially contain evidence. They can also collect the data in a way that maintains its integrity and captures all the metadata. Experts in other technology sectors are not necessarily familiar with evidence preservation techniques and do not use the same tools and procedures to ensure the data is defensibly collected, possibly rendering it unusable in legal matters.<\/p>\n These days, most evidence in litigation is digital, but appearing in court without all the relevant data is like appearing without the whole story. Consider these alternate sources\u2014like where the person in question was, what time, how long and more. In the end, the data you didn\u2019t even know existed might just be the evidence needed to prove your case.<\/p>\n \u00a0<\/em><\/p>\n \u00a0<\/em><\/p>\n Wes Johnson is the senior digital forensic examiner at eDiscovery and digital forensics company <\/em>BIA<\/em><\/a>. He has more than 20 years of experience in forensically retrieving and analyzing computer evidence and providing litigation support. He has analyzed and presented evidence in cases involving theft of intellectual property, theft of trade secrets, fraud, breach of contract, Securities and Exchange Commision investigations, spoliation and destruction of evidence. <\/em><\/p>\n<\/p><\/div>\n\n
Websites<\/strong><\/h2>\n
Tips for Attorneys <\/strong><\/h2>\n
![\"\"](\"http:\/\/dominiclevent.com\/blog\/wp-content\/uploads\/2017\/11\/litigation-300x225.jpg\")
<\/a>