Intorduction
Over the last decade, the computer hard drive has been the main point of data storage and therefore the key source of electronic evidence for investigations and litigation. This has changed rapidly in recent years with the rapid growth of new data storage technologies, such as smart phones, tablet devices and of course 'cloud' storage.
In this article, Daniel Walton, a Forensic Technology manager in our Sydney office, discusses potential new sources of electronic evidence, and some examples of their use in our Forensic Technology team's recent work.
A new digital landscape
Recently there has been a huge explosion in the number of personal electronic devices, triggered by the rapid increase in mobile phone technology and rising internet speeds. Nearly everyone now has a smartphone, with almost their entire lives stored on it, making these devices and internet access the new 'basic human need' (see the image below).
Many people are using their personal devices for both personal and business use – meaning information vital to an investigation or litigation could be stored on a phone or tablet (often a device with internal storage capacity similar to desktop computers from ten years ago). Additionally, information could be retained on devices you have never considered might store data, such as in-car GPS navigation devices, gaming consoles or printers.
We suggest that the following devices should be considered as potential sources of electronic evidence.
The 'Cloud'Cloud Computing is the practice of using an on-demand, robust and scalable network of remote computer technologies to store, manage and process data, rather than using local servers or personal computers. Online data storage, also known as 'cloud' storage, has become a popular way of storing data, and it is now easy for users to back up or copy photos, music and other data remotely to the cloud from mobile phones. This means that organisations should be alive to the possibility of Intellectual Property (IP) theft, as it is now so easy for employees to synchronise company data to their own cloud accounts. Cloud storage sites like Dropbox and Google Drive are common in daily use and can be a convenient tool for misappropriating company data. Also, depending on the setup of a users' mobile device, some users are storing data in the cloud without even knowing: companies such as Facebook, Google Plus and LinkedIn are storing our information on the cloud. It may also be appropriate to consider these sites as potential sources of electronic evidence in an investigation or as part of litigation. |
Recent examples of cases undertaken by our team
GPS
An insurance claim was being investigated regarding a suspicious claim from the Brisbane floods in 2011. The claimant had claimed that their luxury vehicle had been flooded and that this incident could not be avoided. When an examination of the car's on-board computer and GPS was conducted, the evidence showed that the vehicle had been driven toward the rising floodwaters just before the Brisbane River broke its banks. The claimant's story did not match the data from the vehicle's GPS and, as a result, the claim was denied.
DropBox
A staff member left a Company A taking company information with them and then set up a Company B in competition. Analysis of their Dropbox usage showed they had uploaded data from Company A to Dropbox toward the end of their employment and then shared and accessed this information from Company B after they had left. Legal action was taken and this information was used in court.
Digital still camera/smart phone
There was an insurance case in which a claimant claimed to have lost their handbag. This handbag was reported to contain numerous expensive items including a large amount of cash and an iPad. Forensic analysis of the digital photos provided by the claimant showed that these photos had been taken a significant time after the alleged date of loss and just a few hours after the insurance company had asked for photos as proof of the claimed items. The insurance company was then able to decline the claim based on this information.
Conclusion
It's always important to consider the many different types of devices that are now available to store information, or which are perhaps storing information without the user's knowledge!
Whilst personal computers and file servers are still relevant data sources, it is important to make sure that all potentially useful sources of evidence are obtained and reviewed by forensic technology specialists, as they could be pivotal in proving or disproving a case. Furthermore, obtaining data from the cloud is often complex, so when faced with an investigation or litigation, we suggest that acquisitions of cloud data are undertaken by experienced forensic technology specialists to avoid the risk of data modification.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
