This article, Pandora’s Forensic Box: The Data You Didn’t Know Existed, appeared in the publication Law Technology Today, where BIA’s Wes Johnson discusses several types of personal hidden data that users may not know exist on their devices and how that data can be forensically collected and used as evidence in litigation. Whether it’s to prove innocence or guilt, this hidden data is extremely valuable to attorneys, as it could be what makes or breaks a case.
You may be surprised by the type of data that is tracked, not just by phones and computers but even digital assistants, video doorbells and gaming consoles like Xbox or PlayStation. These devices (and many others) can hold incriminating evidence. Alexa can hear suspicious activity or conversations, video doorbells can identify a person’s location, and gaming systems’ chat features can hide questionable exchanges. The bottom line is that most devices connected to the internet are usually tracking some type of information, so you should talk with a forensic professional about any data that may be relevant to your case to determine whether or not it can be collected and used in litigation.
Here are some of the most voluminous compartments inside Pandora’s box of “hidden” digital data:
Location settings on iPhones
Most iPhone users have been cautioned to turn off location settings for certain apps, or at least change the settings to only track their location while they’re using the app. However, few people realize that yet another set of data that you didn’t know existed occurs and that a level of tracking is going on, and that the feature is set to “on” by default. You can see the data for yourself in Settings → Privacy → Location Services → System Services.
This location data is extremely convenient and even necessary for many of the system processes we love, such as apps like “Find My iPhone” (or “Find My” on newer devices), location-based ads or Google searches, or updating your time zone while traveling. However, it can also be incriminating if it happens to put you in a suspicious place at a specific time.
Forensics professionals can make a forensic image of a device and search through its location history to find data that supports their case. Known as “significant locations,” iPhones track the places you visit most often and the dates and times you visit them. If your phone suggests the quickest route to get to and from work, it’s because it has learned the days and times you frequently travel that path. Curious what places your phone recognizes as significant? Within System Services, tap Significant Locations, and you’ll find a list of all the places you have visited often since you purchased your phone.
Hidden data in Android devices and Gmail accounts
Not surprisingly, Androids collect much of the same location data as do iPhones. That data is automatically linked to the Gmail account associated with the device (all Androids require a Gmail account in order to use many of the features). User activity is collected through Google Chrome and Google Maps and tied to Gmail accounts – so with more than 1.5 billion active Gmail accounts, Google gets a lot of data from its users.
Currently, Google collects more than 50 different categories of user data, including:
- Location history
- Web searches and website viewing history
- Shopping information
- Viewed content on YouTube
- Health activity data on connected fitness devices
- Audio of commands recorded on Android-based smart home devices, such as Google Home
If you have an Android device, you can see the activity it stores by going to Settings → Google → Google Account → Data & Personalization → Activity & Timeline → My Activity.
Social media data that you didn’t know existed.
Some social media platforms, such as Facebook and Twitter, have temporary deactivation periods prior to accounts being fully deleted. Both of these websites implement 30-day deletion policies in which a person’s account and all its data is stored for 30 days after the owner has “deleted” it. If the user attempted to hide incriminating evidence by removing his or her account, forensics professionals can discover that evidence, as long as they are acting quickly to preserve the data within the time constraint making it data you didn’t know existed.
Once the 30-day holding period has passed, it becomes much more difficult to recover data from these social media sites, though it is sometimes still possible with a court request or subpoena. However, if the deleted information is significant enough, the simple act of deletion alone during a suspicious time frame could serve as sufficient evidence. In the end, it’s essential to know what social media platforms could hold critical evidence, understand their privacy policies, and act quickly to retrieve the data so that it can be presented during legal matters.
How to Handle Digital Evidence in Litigation?
What data can I collect? When should I start collecting? How do I collect it legally? It’s always a good idea to consult a forensic expert to discuss these important questions. General technology experts have ample knowledge of the technology industry, but they probably aren’t familiar with the tools and techniques required to defensibly collect the various types and formats of data. Trained forensics professionals, on the other hand, are aware of the many places data is stored. If your smoking gun is buried in those Words With Friends chats, our BIA experts will find it. More importantly, we will collect it in a way that maintains the data’s integrity while also capturing the metadata, so you don’t run into issues down the road when you try to use that data in court.
With more and more evidence being found online, it’s wise to carefully consider a suspect’s entire digital footprint and the evidence it may contain before litigation occurs. Forensics experts may be able to mine multiple sources and uncover data you didn’t know existed – data that might even expose the smoking gun.
Got Data? We can help.
Read more about how to collect data, put it to work, and win your case.