Often misunderstood and definitely underutilized, digital forensic evidence is the “smoking gun” in many legal cases of the 21st Century.  Because of our frequent addiction to social media, email, internet and our phones we have created quite the digital footprint that will remain around for years to come and could be a person’s downfall in a court of law.  However, proper collection and examination of a computer or cell phone hard drive is critical to the success of the case and to avoiding jail time or lawsuits for invasion of privacy.

We are not in the business of giving legal advice, but would caution anyone considering utilizing a forensic investigator to carefully review the following:

 Electronic Communications Privacy Act of 1986 (ECPA)

 Cable Communications Policy Act (CCPA)

 USA Patriot Act of 2001

 Privacy Protection Act of 1980 (PPA)

What is important to note is the method of obtaining this evidence, who has the right to access it and the manner in which it is examined.  Equally important to the case, is ensuring that the investigator utilized is not only properly licensed and insured but also has invested in the technology and training to conduct a proper assessment of the evidence.  There are a number of investigators claiming to offer these services, but who are not actively involved in associations which share knowledge on the science behind it, nor have they committed to purchasing (the often very expensive) software and hardware to perform a quality scan.

Wondering how this evidence can be used:

 An attorney is representing a client in a traffic fatality in which the defendant driver has clearly denied using a cell phone at the time of the collision despite witnesses stating the opposite.  Regardless of whether the messages were already deleted or not, a forensic examination of the phone (with his/her consent) could prove or disprove their claims.

 Does a woman suspect her husband is cheating on her, but concerned about how easy it will be to successfully conduct a traditional surveillance based investigation.  If he is syncing his phone to a family owned and used computer in their house then she has every right to give that device to us for examination.  We will remove and/or image the hard drive, return it to it’s location and review every file (present or deleted) that still exists on the device.  One such case allowed us to locate deleted chat messages from Yahoo that were only sent via the subject’s phone and then immediately deleted.  However, when she backed up the phone to the computer, the Mac grabbed all files included those deleted chats and stored them on the computer.  Needless to say, we found “50 Shades of Gray”.