Copyright 2026, Steve Burgess

Every so often I’ll sit across the Zoom from an attorney—or from a pro se litigant—who wants everything. Every text message the opposing party has ever sent. Every photo on their phone. Every search query. Every deleted file. Every app. Every cloud account. Of course, I’ve also had those calls where I think they don’t want enough. But they’re the boss here.

In other words, they want the digital equivalent of dumping every piece of dirty clothing on your teenager’s bed to find your missing sock. I understand the impulse. Somewhere in there might be the thing that wins the case.

But “it might be in there somewhere” is not how discovery is supposed to work. It’s also not how a forensic examination should work, because privacy doesn’t evaporate simply because someone becomes a party to a lawsuit.

This tension—between the legitimate need to discover relevant evidence and the very real privacy interests of the person whose device is being examined—sits at the center of much of the work I do. It’s worth understanding how courts actually navigate it, because the answer is more nuanced than either “produce everything” or “produce nothing.” Attorneys who understand that nuance generally get better results than those who don’t.

The starting principle in most jurisdictions is proportionality. Discovery requests, including requests for forensic examination of a device, are generally supposed to be tailored to what’s relevant to the claims and defenses in the case—not a fishing expedition through someone’s entire digital existence.

Courts have increasingly pushed back on requests for complete forensic images of phones and computers, particularly when narrower methods can capture the relevant evidence without exposing unrelated personal material.

A request for “all text messages with this specific person during this specific time period” tends to fare much better than “give me the phone.”

After all, if someone sued you over a fender-bender, you probably wouldn’t give them your garage door opener and let them check every shelf and rag just in case they find something useful.

This is where forensic protocols come in, and they’re more sophisticated than most non-experts assume.

A forensic examination doesn’t have to mean someone reading every photo and message on a device. Searches can be scoped by date range, keyword, contact, application, file type, or a combination of all of these. Privileged or clearly irrelevant material can be filtered before opposing counsel ever sees the results.

Courts will sometimes appoint a neutral third-party examiner—someone retained by neither side—specifically to address privacy concerns. The examiner produces only responsive material under a protocol agreed upon in advance. I’ve worked within that structure many times, and it tends to satisfy both the legitimate discovery need and the legitimate privacy objection, which is no small trick. Getting two opposing attorneys to agree on anything is occasionally harder than recovering data from a damaged hard drive.

There’s also a category of information that receives special treatment regardless of relevance concerns: health information, financial account credentials, privileged attorney communications, and in some jurisdictions, location data tied to sensitive activities. Courts are generally more protective of these categories, and a request that sweeps them in without specific justification is likely to draw a motion to quash—and probably deserves to.

The practical lesson for attorneys on either side of this issue is the same: be specific.

If you’re requesting examination of a device, define the scope as narrowly as the case allows. You’ll encounter fewer objections, spend less time arguing, and generally get faster compliance.

If you’re objecting to a request, propose an alternative that addresses the actual relevance concern rather than simply saying no. “No” by itself rarely survives a motion to compel for very long. Unless of course, it’s that aforementioned teenager.

Privacy and discovery aren’t really opposites. They’re both trying to answer the same underlying question: What information is actually necessary to resolve this dispute fairly?

The cases that move most smoothly are usually the ones where both sides—and their experts—keep that question in view instead of treating discovery as an opportunity to rummage through someone’s entire digital sock drawer.

And trust me, after examining thousands of devices over the years, I can assure you that most digital sock drawers contain exactly what you’d expect: lots of clutter, a few surprises, a number of screenshots of questionable provenance whose purpose has been lost to history, and almost never the thing you were originally looking for.

So, as an attorney, where do you usually draw that line when negotiating the scope of a forensic examination?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Digital Privacy vs. Discovery: Where the Line Is Drawn appeared first on Burgess Forensics.

Copyright 2026, Steve Burgess

Smartphones are the single richest source of digital evidence in most litigation today. Text messages, call logs, photos, location history, app data, deleted files — it’s all there, sitting in a device that fits in a shirt pocket. Or in that back pocket that’s covered with bling. You’d think that because phones are so ubiquitous and so central to how people communicate, attorneys and their clients would have developed good instincts about preserving them. You would be wrong, and I say that with forty years of forensic experience and genuine affection for the legal profession.

The mistakes I see aren’t necessarily the result of bad intentions. They’re the result of people not knowing what they don’t know — which, in digi

tal forensics, turns out to be quite a lot. Here are the three that do the most damage.

Mistake One: Letting the Client Keep Using the Phone.

This one is so common that I’ve stopped being surprised by it, though I haven’t stopped being pained. The moment litigation is reasonably anticipated, a litigation hold applies to that phone. What it does not do, unfortunately, is apply itself. Unless someone explicitly tells the client to stop using the device normally, they will continue using it norma

lly — deleting old messages to free up space, backing up and syncing, downloading updates, letting apps purge their caches — all of which can overwrite the very data that might have been recoverable. The phone doesn’t know there’s a lawsuit. It’s just doing its job..

Even using the phone abnormally, that is – at all – makes potentially important changes to data that

could be responsive, and can also make otherwise recoverable data gone from the planet.

The fix is straightforward but has to happen early: tell your client, in plain language, to stop deleting anything and to bring you the phone. Not a screenshot of the phone. The phone. Best to put it into airplane mode and then turn it off immediately. We’ll get to screenshots in a moment.

Mistake Two: The Screenshot Problem.

Attorneys receive screenshots of text message conversations constantly. Clients send them because they’re easy, because they feel like evidence, and because nobody told them otherwise. The problem is that a screenshot is a photograph of information, not the information itself. It shows you what someone wants you to see, cropped to whatever boundaries they chose, dating the evidence to the very time they took the screenshot, with none of the underlying data that makes digital evidence actually useful in court.

Even worse, we regularly get PDFs of screenshots of the evidence, two steps of creation removed from the genesis of the underlying evidence.

A proper extraction of text messages from a phone includes the full conversation thread, the phone numbers associated with each contact, timestamps that can be verified against carrier records, and in many cases deleted messages that the client may not even know still exist. A screenshot gives you none of that. It also gives opposing counsel a straightforward authenticity challenge, because a screenshot can be edited in about thirty seconds by anyone with a basic photo app and an agenda. Courts are increasingly skeptical of screenshots standing alone, and rightly so. If the text messages matter to your case, get the phone examined by someone who can extract the data forensically.

Mistake Three: The Factory Reset.

This is the one that occasionally crosses the line from mistake into something courts take a very dim view of, depending on the timing and the circumstances. People factory reset their phones for all kinds of innocent reasons — selling the device, switching carriers, trying to fix a software problem, general digital housekeeping, following the instructions of a tech support rep. Even just copying the data to a new phone. Hit the wrong button during the process and Poof! All the un-transferred stuff is gone. When it happens after litigation is anticipated and a litigation hold is in effect, innocent reasons tend not to matter as much as you’d hope.

What many people don’t realize is that a factory reset, once it happens, puts you in a very difficult position legally — regardless of what may or may not remain on the device. Which, with newer devices, is usually zilch. Courts don’t look kindly on resets that occur after a litigation hold is in effect, and the explanation of ‘I didn’t know’ tends to land with a thud. The time to have this conversation with your client is before it happens, not after.”

The common thread in all three of these mistakes is timing. Digital evidence is not like paper evidence — it doesn’t just sit in a filing cabinet waiting patiently for someone to come find it. It’s dynamic, it’s fragile in ways that aren’t obvious, and the window for preserving it can close faster than anyone expects. The attorneys who understand this engage a forensic examiner early, preserve the device properly, and go into discovery knowing what the phone contains. The ones who don’t tend to find out what was on it the hard way.

If your client’s phone was examined today, would you know what’s on it — or would you find out the same time opposing counsel does?

Don’t miss a single issue of our informative newsletter … Subscribe!

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

The post The 3 Phone Mistakes That Destroy Digital Evidence Before Trial appeared first on Burgess Forensics.

I’m sure that you have reviewed a lot of preservation letters. Some of them are excellent — thorough, specific, and sent at exactly the right moment. Others read like they were written in 1997 and then never updated, which, in fairness, some of them were.

Still others never got sent. So many times I have talked with a client whose STBX (soon-to-be-ex) spouse or otherwise opponent was still using their phone when incriminating texts may not yet have been nuked – but were about to be, and no preservation letter yet sent.

The common ESI preservation letter asks for emails, text messages, and documents on the company laptop. And maybe some Cl    oud-stored stuff. That’s a start. It’s just not nearly enough anymore. The average person in 2026 interacts with digital data across a dozen different platforms and devices every day, and most of that data isn’t sitting in anyone’s email inbox waiting to be requested. Here’s what’s missing from most of the preservation letters that cross my desk.

Cloud storage. Dropbox, Google Drive, OneDrive, iCloud, Box — documents, photos, and entire folder structures live here, often synced automatically without the user giving it much thought. And it’s pretty hard for the user to fake certain metadata with items stored in the Cloud. Employees routinely save work files to personal cloud accounts. People share contracts and photos and videos through cloud links. And when someone deletes a file from a cloud account, the provider may retain version history or deleted-file recovery for weeks. Your letter needs to name the platforms, not just say “any cloud storage.”

Collaboration tools. Slack, Microsoft Teams, Google Chat — these have become where business actually happens for many. Decisions get made in Slack channels. Strategies get discussed in Teams threads. Embarrassing things get said in what people wrongly believe are ephemeral DMs. These platforms retain message histories, shared files, and even the edited or deleted messages in many cases. If the case involves workplace conduct, a dispute between business partners, or anything that happened inside a company in the last several years, this data is essential.

Vehicle telematics. This one surprises people. Many modern vehicles record GPS routes, speed data, hard braking events, phone call logs through Bluetooth, and in some cases even audio clips. That data often syncs to the manufacturer’s cloud. In a personal injury case, a business dispute over where someone was and when, or any matter involving vehicle use, a car can be a witness. A surprisingly reliable one, actually — unlike human witnesses, it doesn’t misremember and it doesn’t have an agenda.

Smart home and IoT devices. Alexa heard something. The Ring doorbell recorded it. The Nest thermostat knows when someone was home. Fitness trackers log sleep patterns and heart rates. These devices generate and store data continuously, and that data is often synced to cloud accounts that can be subpoenaed. I’ve worked cases where a FitBit let us know when a person had likely died and what led up to it. Don’t overlook these.

Social media, including private messages. Most attorneys remember to ask about public social media posts. Fewer remember to ask about the direct messages, the stories that disappear after 24 hours (though not always from the platform’s servers), and the private groups. Instagram DMs, Facebook Messenger, Snapchat, WhatsApp, Signal — these are where candid conversations happen. People say things in private messages they would never commit to email.

Backup systems. Time Machine on a Mac, Windows Backup, NAS drives, corporate backup servers — these can contain historical versions of files that no longer exist on the primary device. The document that was altered before it was produced? An older version may be sitting in a backup that nobody thought to preserve.

Send the letter early. Send it before filing if you can. And when you send it, be specific — general language gives the other side every opportunity to claim they didn’t understand what was covered. The data you fail to preserve is the data you’ll spend the rest of the case wishing you had.

Steve Burgess is a digital forensics expert witness with 40+ years of experience and more than 20,000 cases examined. He founded Burgess Forensics in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Your Preservation Letter Is Missing These 6 Data Sources appeared first on Burgess Forensics.

(copyright Steve Burgess 2026)

One of my favorite client conversations goes something like this:

Client:
“I deleted it.”

Attorney:
“Can you get it back?”

Forensic examiner:
“…define ‘it.’”

Television has taught us two completely opposite and equally wrong ideas:

1. Deleted means permanently destroyed forever.

OR

2. Digital forensics can recover anything short of a laptop being launched into the Sun. And once we make a spacecraft capable of diving into the corona…

Reality, as usual, lives in the awkward middle.

When people delete data, they’re often removing references to the data—not instantly vaporizing every underlying bit.

That’s why deleted material can sometimes remain recoverable.

But—and this is the part TV skips—not always.

Recovery depends on things like:
• what device it was on
• what app created it
• what happened afterward
• syncing behavior
• encryption
• elapsed time
• whether storage has been reused

And occasionally, the answer is simply: no.

I know – not nearly as dramatic as enhancing a reflection from somebody’s sunglasses. Which usually just turns out to be an image of you snapping the photo.

One of the most useful questions an attorney can ask early isn’t:

“Can you recover deleted data?”

It’s:

“What are the conditions that would make recovery possible?”

That changes the conversation from magic to evidence.

It also helps set expectations for clients.

I’ve had many, many cases where deleted evidence became central.

I’ve also had matters where the deletion itself ended up being more informative than the missing content. Spoliation, anyone?

Either way, certainty usually arrives later than a story on the Internet suggests.

And no forensic examiner should be promising miracles in the first phone call.

Question for attorneys:
Have you had a case where the existence—or absence—of deleted data changed strategy?

The post Deleted Does Not Always Mean Gone (But It Doesn’t Mean Recoverable Either) appeared first on Burgess Forensics.

Digital Evidence Is Bigger Than Most Cases Realize

copyright Steve Burgess 2026

There’s a scene in television forensics that appears in approximately 94.27% of all episodes.

Someone in a dark room says, “Pull up the computer.”

Then ten seconds later, another person says, “Got it.”

Case solved.

I regret to report that reality remains stubbornly less cooperative.

After decades working with attorneys on digital evidence, one thing still surprises me: how often a case that appears to have “no digital component” turns out to have digital evidence everywhere.

Employment dispute? Texts, cloud storage, metadata.

Partnership disagreement? Shared drives, USB device history, email drafts.

Family matter? Phones, photos, location history, account access. Earlier versions of a not-quite-last will and testament.

Construction case? Documents, revisions, messages, timestamps.

Even the cases that begin with, “There really isn’t any computer evidence…” frequently end with someone saying, “Wait… where did THAT come from?”

Part of the challenge is that people still think of digital evidence as a computer sitting under a desk.

Today it’s usually spread across:
• phones
• cloud services
• messaging apps
• browser history
• backups
• documents
• photos
• notifications
• connected devices

And no, before anyone asks: the answer is usually not “image every device and search for the word fraud.”

The most effective forensic work often starts with a surprisingly boring question:

What are we actually trying to prove, or at least, find indicators of?

Once that’s clear, the evidence universe shrinks dramatically.

I’ve seen attorneys spend tens of thousands collecting data they never needed. Not that I minded the funds, even if my advice to limit the search was ignored.

I’ve also seen tiny overlooked artifacts change the direction of a case.

The point isn’t that every case needs digital forensics.

It’s that nearly every case now has digital evidence somewhere.

Sometimes the trick isn’t finding – it’s realizing it was there all along.

Here’s a question for attorneys: what’s the most unexpected source of evidence you’ve seen show up in discovery?

Let me know and I’ll put it in a future post.

Steve Burgess has been doing digital forensics since 1985 and has examined more than 20,000 devices and pieces of digital evidence. He can be reached at (866) 345-3345 or steve@burgessforensics.com.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Digital Evidence Is Bigger Than Most Cases Realize appeared first on Burgess Forensics.

Metadata as a Silent Witness: What It Can Reveal About Your Case

Copyright 2026, Steve Burgess

Every digital file has two stories to tell.

The first is the one you can read — the contract, the email, the photograph. The second story is invisible, buried in the file itself, and it doesn’t care what the first story says. That second story is the metadata, and in four decades of forensic work, I’ve watched it blow up more than a few very confident cases.

Think of metadata as the file’s diary. While the document presents its polished face to the world, the diary in the background is quietly recording everything — when the file was actually created, who created it, what software was used, how many times it was edited, and sometimes even where on the planet the device was sitting when someone hit “save.” The document will say whatever its creator wants it to say. The metadata just tells the truth…your own little whistleblower.

What Exactly Is Metadata?

Metadata is data about data. (Computer scientists have a gift for naming things that would bore a golden retriever to sleep, but this one is actually accurate.) Every file type carries it, and every file type carries different kinds.

A Word document records the author name, the organization the software is registered to, creation date, last modified date, total editing time, and sometimes a revision history that shows you every embarrassing draft along the way. A PDF carries similar but more limited information – still with details about what application generated it. A photograph records the camera model, lens settings, and — if the camera or phone had GPS enabled — the exact coordinates where it was taken, accurate to within a few feet. An email carries IP address headers that can tell you where in the world it actually originated, regardless of what the “From” line shows. Even a simple spreadsheet logs who last touched it and when.

All of this is invisible in normal use. Open a contract in Word and you’ll see the contract. Open it in a forensic tool and you might see the contract’s entire biography.

The Contract That Wasn’t

A few years ago, I was engaged in a criminal case where the defendant – a truckler – produced an alleged agreement signed months earlier, in order to justify having let a truckload of perishables perish – the latter potentially being a Federal crime. The defendant produced a MS-Word document and a PDF of the email to which it was attached.

The defense attorney asked me to take a look.

Metadata showed previous versions of the document that were months later than the current version of the document. I told the attorney that the defendant must have manually backdated his computer so that the file would look like it was created a long while before it actually was. And that a police forensic examiner was likely to find this out as well.

Busted!

There’s not an attorney around that wants to find his client lying to him.

The defendant had created a document, backdated the content, and either forgotten or didn’t know that the file itself would remember the truth. 

The judge was very unhappy. 

Unhappy judges aren’t good for dishonest defendants and jail time ensued.

The Photograph That Placed Someone at the Scene

Photo metadata — formally called EXIF data — is a gift to investigators and a headache for anyone who thought their location was private.

Modern smartphones embed GPS coordinates into every photograph by default. Most people don’t know this. Some people find out at exactly the wrong moment.

In more than one criminal case I’ve worked on, defendants claimed to be out of town on the day in question. The Public Defender had a hunch and asked me to examine the defendant’s phone and photos from around that time.

In one case, the EXIF data from one photograph showed it was taken at coordinates that put the defendant squarely in the city he claimed to have been away from — at the time he claimed to have been somewhere else entirely. In another, it showed the phone was nowhere near the scene of the crime at the time of the crime. GPS coordinates in a photograph, captured automatically at the moment the shutter clicked, are really hard to explain away.

The Email That Came From the Wrong Continent

Email headers are metadata too, and they’re something most attorneys never look at. When you view an email, you see the sender’s name, the subject, and the body. Behind all of that is a chain of technical information recording every server the email passed through on its way to you, including the originating IP address — the digital address of the computer or device that actually sent it.

I’ve examined cases where someone claimed to have received a threatening email from a business rival. A look at the email headers told a different story: the message had originated from an IP address registered to the supposed victim’s own internet service provider, in the same city, on the same block. Someone had sent a threatening email to themselves.

I’ve also seen the reverse — cases where a company denied sending communications to a former employee, and the headers showed the emails came straight from their own mail server. Denials are cheap. Headers are not.

When Metadata Helps Your Client — and When It Doesn’t

Here’s the thing that only some attorneys understand: metadata is evidence. It’s neutral. It will help you if the facts are on your side and hurt you if they’re not. What it won’t do is stay hidden.

If opposing counsel has a forensic expert and you don’t, they may be examining your client’s documents right now and finding things neither of you anticipated. Metadata doesn’t require a subpoena. It’s already in the file.

This means two things for your practice:

First, when you receive digital documents in discovery, don’t just read them. Have them examined. A document that looks perfectly legitimate might be telling a completely different story in the background, and you want to know that before the other side does.

Second, when your client is producing documents, know what’s in them before they go out. I’ve seen cases nearly derailed by metadata in the producing party’s own documents — revision histories that showed the “final” contract had been edited six times after the claimed execution date, or author fields that identified someone whose involvement was supposed to be unknown. Producing documents in PDF format strips some metadata, but not all, and there are forensic methods for recovering more than people expect.

Of course, I’ve had attorneys examine the metadata of their own guy’s evidence to see if their client was on the up-and-up. Sometimes they’re not.

A Note on Photos and GPS

If you’re handling any case where location matters — a slip-and-fall, a fraud claim, an alibi — it’s a good idea to ask whether photographs are in evidence. Then ask whether anyone has looked at the EXIF data. The answer to the second question is frequently no.

Most people share photographs constantly without any awareness that they’re broadcasting their exact location in the file. Courts have admitted GPS metadata from photograph EXIF data as location evidence. It’s the digital equivalent of a witness who was there, has perfect recall, and cannot be cross-examined.

What To Do About It

Get a forensic expert involved early. Not after you’ve already produced documents, not after discovery is closed, not the week before trial. Early.

A competent digital forensics examiner can tell you what the metadata in your documents actually says before you stake a claim on them. They can examine opposition documents and identify inconsistencies you’d never notice reading normally. They can authenticate photographs, trace emails to their source, and give you a clear picture of whether the digital evidence in your case is supporting the story you’re trying to tell — or quietly undermining it.

Metadata doesn’t take sides. It doesn’t forget. It doesn’t get nervous on the stand.

It just sits there in the file, waiting for someone to ask the right questions.

The Takeaway

Every digital document in your case has metadata. Some of that metadata is irrelevant. Some of it is the most important evidence in the file. You won’t know which until someone looks.

Don’t wait to find out from opposing counsel.

Steve Burgess has been doing digital forensics since 1985 and has examined more than 20,000 devices and pieces of digital evidence. He can be reached at (866) 345-3345 or steve@burgessforensics.com.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Metadata as a Silent Witness: What It Can Reveal About Your Case appeared first on Burgess Forensics.

Email, Texts, & Cloud Data: Where Critical Evidence Hides, Part II       

Copyright 2026, Steve Burgess

In over four decades of digital forensics work, I’ve examined more than 20,000 devices and pieces of digital evidence. And in that time I’ve developed a reliable theory: the evidence that counts – that might win or lose a case is rarely sitting where the attorneys expected to find it.

It’s hiding. Not maliciously — well, sometimes maliciously — but more often just because nobody thought to look there.

Let me tell you about some of the places where the good stuff actually lives.

The Email You Didn’t Ask For

Attorneys ask for emails. That’s great. What they often forget is that email is not one thing — it’s a collection of things, each with its own quirks, its own storage habits, and its own forensic personality.

Consider Outlook. When you delete a message in Outlook, it doesn’t vanish. It goes to the Deleted Items folder. When you empty that folder, it still doesn’t vanish — not entirely. The message gets marked as deleted in the PST or OST file, but the data hangs around – not just in unallocated space – but also right in the file,  like a houseguest who doesn’t take hints. A forensic examiner can often recover those messages intact, complete with headers, timestamps, and attachments. Your client’s opponent who “deleted everything” may have deleted nothing of consequence at all.

Then there’s webmail — Gmail, Yahoo, Outlook.com, and their cousins. Here’s where it gets interesting for attorneys. The messages don’t live on the user’s computer in the traditional sense. They live on the provider’s servers. That means you may need a subpoena or a preservation request to Google or Microsoft, and you need to move on that quickly, because providers don’t hold onto data forever out of the goodness of their hearts. Gmail keeps deleted messages in Trash for 30 days. After that, they’re gone from the server — though sometimes not entirely gone from a forensically imaged phone or computer that was syncing that account.

One more thing about email that trips people up: the headers. Nobody reads email headers. Attorneys definitely don’t read email headers. But headers tell you the actual IP address the message came from, the route it traveled, the mail servers it touched. And here’s the beauty of email saved in the provider’s servers – the user can’t really fake the dates and the precise timestamp, because those are assigned by the server, which is not in the user’s control. I’ve had cases where someone claimed an email was sent from one city when the header told me, very clearly, it was sent from another city entirely. Headers don’t lie. People do.

Texts: More Than Just “Hey”

SMS text messages are a goldmine. Most people treat them casually — the digital equivalent of talking out loud — which means they say things in texts they’d never commit to a formal email. I’ve seen business deals negotiated entirely over text. I’ve seen admissions, threats, and instructions that made attorneys’ eyes go wide when we produced them.

The forensic wrinkle is device dependency. Unlike email, which typically has a server-side copy, SMS and iMessage messages often live primarily on the device itself. If that device hasn’t been preserved, you may be looking at a very uncomfortable conversation with your client about spoliation.

But don’t give up too quickly. A few things to remember:

iMessage has iCloud backup. If the user had iCloud backup enabled — and most iPhone users do, at least for a while — there may be a backup copy of the messages in the cloud. Apple will respond to valid legal process, although they may resist a bit. The preservation window isn’t infinite, but it exists.

Android devices with Google accounts often back up SMS data to Google’s servers as well, depending on device settings and the apps installed. Samsung has its own backup ecosystem. The point is: the phone is not the only place to look.

Carrier records are another option. Wireless carriers retain metadata — who texted whom, when, and from what number — for varying periods. AT&T, Verizon, T-Mobile: they all have legal compliance departments that respond to subpoenas. You won’t get the content of the messages from the carrier, but you’ll get the records of communication, which can be extremely valuable for establishing a timeline or refuting someone’s claim that they “never contacted” the other party. And cell tower records can point where the user’s phone was when they were using it.

The Cloud: Where Everything Lives Now, Even the Things You Forgot About

Cloud storage is the gift that keeps on giving — to forensic examiners, anyway.

Google Drive, iCloud, Dropbox, OneDrive, Box: people store documents, photos, videos, and files in the cloud without thinking much about it. They also forget what they’ve stored there. This creates a wonderful situation where the evidence is sitting in the cloud, perfectly preserved, while the person who put it there has completely forgotten it exists. I have been on the beneficial end of this situation more than once.

One case that comes to mind involved a business dispute where the defendant insisted he had no copies of certain proprietary documents. His hard drive, conveniently, had been wiped. His phone, also conveniently, was new. But his Google account had been syncing files from his old computer for two years. Those documents were sitting right there in his GDrive, timestamped and everything. Not wiped. Not new. Just waiting.

The lesson: always ask about cloud storage accounts as part of your discovery requests. Not just “do you use Dropbox” — ask about all of them. Google Drive. iCloud. OneDrive. Box. Evernote. There’s more. Even Adobe Creative Cloud if the case involves documents or design files. People have more cloud accounts than they realize, and they rarely think of them as places where evidence lives.

Messaging Apps: The New Wild West

Here’s where attorneys really leave evidence on the table.

WhatsApp, Telegram, Signal, Facebook Messenger, Instagram DMs, Snapchat, WeChat, Line — and whatever new platform launched last Tuesday. These are messaging apps, and they are increasingly where people conduct their most candid conversations. They feel private. They feel ephemeral. They often aren’t.

WhatsApp stores message databases on the device, and — critically — backs them up to either Google Drive or iCloud. Those backups are not encrypted with the same end-to-end encryption that protects messages in transit. That’s a significant forensic opportunity if you can get access to the backup.

Telegram stores messages on Telegram’s own servers unless the user specifically uses the “Secret Chat” feature. Regular Telegram chats are cloud-based and accessible from multiple devices. The fact that someone deleted a Telegram message on their phone does not mean the message is gone everywhere.

Signal is the hard one. Signal is designed to be forensically resistant. It uses end-to-end encryption, stores messages locally, and gives users easy tools to set messages to auto-delete. However, the device itself can sometimes still be examined if we have access to it and the right tools. And sometimes people screenshoot Signal messages and those screenshots end up somewhere more recoverable. People undermine their own secure communications with impressive regularity.

Snapchat is a perennial source of confusion. “But it disappears!” No — it disappears from the app’s interface. Snapchat retains opened snaps on its servers for a period after opening, and unopened snaps for longer. Forensic examination of the device can also reveal plenty of evidence of Snap activity even after “disappearance.” And again: screenshots. Always screenshots.

Location Data: The Witness Who Never Lies (Much)

I’ll include this one because it relates to cloud data and it’s massively underutilized.

Smartphones are location-tracking devices that also make phone calls. The location data that accumulates in cloud accounts — Google Timeline, Apple’s Significant Locations, fitness apps, rideshare apps, photo metadata — can place a person at a specific location at a specific time with remarkable precision.

Phones don’t keep an audit trail of all locations – too many users screamed about that several years ago and the providers just stopped – but as above, it can be derived, inferred, and actually found from other artifacts.

I’ve worked cases where Google Timeline data provided a minute-by-minute account of where a phone traveled on a given day. Photo EXIF data embedded GPS coordinates and timestamps in every image. The phone didn’t just know where the person was — it was more than willing to tell us.

The catch: much of this data is tied to cloud accounts and requires preservation requests or legal process. Some of it is stored only on the device. Either way, if location is at issue in your case, ask your forensic expert about it early.

A Word About Preservation

Everything I’ve described above comes with an expiration date. Email gets purged. Carrier records get overwritten. Cloud backups get replaced by newer backups. Messaging app logs get deleted. The evidence isn’t gone yet — but it will be.

The single most expensive mistake I see attorneys make is waiting too long to engage a forensic examiner. By the time the case heats up and someone thinks to ask about the text messages, the carrier retention window has closed, the phone has been traded in, and the iCloud backup has been overwritten fourteen times. I’ve seen this plenty of times and they attorney can only say, “if only…”

Digital evidence doesn’t wait for a convenient moment in your litigation schedule. Issue litigation holds early. Serve preservation letters early. Call a forensic expert early — ideally before the evidence knows it’s being looked for.

After 40 years and 20,000-plus look-sees, I can tell you that the cases that get won on digital evidence are usually the ones where someone moved fast. The cases that get lost on digital evidence are usually the ones where someone assumed the evidence would still be there when they got around to it.

It wasn’t.

Steve Burgess is a digital forensics expert witness and the founder of Burgess Forensics, one of the longest-established independent digital forensics practices in the United States. He has examined more than 20,000 cases over four decades and provides expert witness testimony in civil and criminal matters nationwide. He can be reached at burgessforensics.com.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Where Critical Evidence Hides: Email, Texts, & Cloud Data Part II appeared first on Burgess Forensics.

Can You Trust What You See? The Rise of Deepfakes and What It Means for Justice

Copyright 2026, Steve Burgess

I’ve been working with digital evidence since 1985, and I’ve seen a lot of changes. Back then, the biggest challenge was recovering data from a 10 MB hard drive—yes, megabytes, for you youngsters who think gigabytes are small. But nothing compares to what’s happening right now with artificial intelligence.

Here’s something that should concern everyone: we’ve reached a point where anyone with a smartphone can create fake videos, photos, and audio recordings that look and sound completely real. Not “pretty good” fakes that experts can spot. I’m talking about fakes so convincing that even professionals like me have trouble telling the difference. And trust me, after 40 years of staring at computer screens, my ability to spot weird pixels is legendary.

This technology is called “deepfake” AI, and it’s already being used in courtrooms, whether judges and juries realize it or not.

What Are Deepfakes?

Think of deepfakes as Photoshop on steroids. Photoshop that went to Gold’s Gym, got a PhD in computer science from University of Phoenix, and decided to cause chaos. But instead of just touching up a photo, this technology can:

• Put your face on someone else’s body in a video
• Make you appear to say things you never said
• Create recordings of your voice saying anything
• Generate completely fake images that look like real photographs

The scary part? This used to require expensive equipment and expert knowledge. Now there are apps that can do it on your phone in minutes. The same phone you use to watch cat videos and argue with strangers on the Internet.

Why This Matters in Court

Imagine you’re on a jury. The prosecutor shows you a video of the defendant at the crime scene. It looks real. It sounds real. The metadata (the hidden information in the file) says it was recorded at the right time and place.

But what if that video was created by AI? What if the defendant was never actually there?

Or flip it around: what if you’re accused of something, and there’s a fake video showing you doing it? How do you prove it’s not real when it looks so convincing?

This isn’t hypothetical. These situations are already happening in courtrooms. Welcome to the future, where “the camera doesn’t lie” is officially retired as a saying.

The Old Rules Don’t Work Anymore

For decades, we’ve had pretty good ways to tell if photos and videos were tampered with. We could look at the file’s internal structure, check when and where it was created, and spot the digital fingerprints left behind when someone edits an image.

But AI-generated fakes don’t leave those fingerprints. They’re not edited versions of real photos or videos—they’re created from scratch. There’s nothing to compare them to because there was never an original.

It’s like trying to prove a painting is a forgery when there’s no original painting to compare it to.

What’s Being Done About It

The good news is that courts are starting to take this seriously.

In 2025, new federal rules were put in place that require stricter verification of digital evidence that might involve AI. Judges can now demand that experts test evidence with multiple detection tools before it’s allowed in court.

Some tech companies are also developing authentication systems. Think of it like a tamper-proof seal on a medicine bottle, but for digital files. These systems create a kind of digital signature the moment a photo or video is captured, proving it’s authentic.

The problem? Most phones and cameras don’t have this technology yet, and it could be years before it becomes standard. So, we’re in that awkward phase where the bad guys have a bunch of cool toys and the good guys are still waiting for their equipment to ship.

How Do Experts Catch Fakes?

I wish I could tell you we have a foolproof method, but we don’t. If I had one, I’d be drinking mojitos on a beach somewhere instead of writing this article. What we do is use multiple approaches:

Run detection software. There are programs specifically designed to spot AI-generated content. They’re not perfect, but they can catch many fakes.

Look for impossible things. Sometimes AI makes mistakes—lighting that doesn’t match, shadows falling the wrong way, people with eleven fingers, or physics that just don’t work in the real world. AI is smart, but it still occasionally forgets how gravity works.

Check the story. Where did this evidence come from? Who had access to it? Does it make sense that this file exists?

Compare with other evidence. If you have ten photos from an event and nine look normal but one looks suspicious, that’s a red flag.

The truth is, detecting deepfakes is getting harder as the technology improves. The detecting tech gets better, too. But it’s an arms race, and right now, the fakers are ahead. It’s like playing whack-a-mole, except the moles have PhDs and keep getting smarter.

What This Means for You

You might be thinking, “I’m not a lawyer or a forensics expert. Why should I care?”

Here’s why: we’re all going to be affected by this technology.

Maybe you’ll serve on a jury and need to decide if evidence is real. Maybe you’ll see a video of a public figure saying something outrageous (that they never actually said). Maybe someone will use this technology to fake evidence against you or someone you love. Or maybe you’ll just want to know if that video of your uncle “dancing” at the wedding is real or if someone’s playing a prank.

We’re entering a era where “seeing is believing” is no longer true. That’s a fundamental shift in how we understand reality and truth.

What You Can Do

Be skeptical. Just because a video looks real doesn’t mean it is. This is especially important for dramatic claims or shocking content. If it seems too crazy to be true, it might be—but then again, it’s 2026, so who knows anymore.

Check sources. Before believing or sharing something, try to verify where it came from. Is it from a credible source?

Understand the stakes. In legal situations—whether it’s a court case, an insurance claim, or a business dispute—insist on proper verification of digital evidence.

Stay informed. This technology is evolving rapidly. What’s true today might be outdated in six months.

Looking to the Future

I’ve been doing this work for over 40 years, and I’ve learned that technology always creates new challenges. But we adapt. We develop new tools, new methods, new ways of finding the truth. It’s what keeps forensic experts like me from having to learn how to do something sensible, like accounting, or racing cars.

Courts are updating their rules. Researchers are building better detection tools. Tech companies are working on authentication systems. It’s going to take time, but we’ll figure this out.

In the meantime, we all need to be more careful about what we believe and more demanding about proof. The old saying “don’t believe everything you see on the Internet” has never been more important.

Because in 2026, sometimes you can’t believe your own lyin’ eyes. Which is a little ironic, because your eyes aren’t the ones lyin – it’s the computers. But try explaining that to a jury.

Steve Burgess has been working in digital forensics since 1985 and has examined evidence in over 20,000 cases. If you have questions about digital evidence or think you might be dealing with AI-generated content, Burgess Forensics can help. We also promise not to create any deepfakes of you. That’s in our mission statement.
steve@burgessforensics.com     

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Can You Trust What You See? The Rise of Deepfakes and What It Means for Justice appeared first on Burgess Forensics.

Deepfakes, AI, and the New Frontier of Digital Evidence Copyright 2026, Steve Burgess

It was true forty years ago and it’s truer today: “Just because it’s digital doesn’t mean it’s true.”

We’re now facing a challenge that would have seemed like science fiction when I started doing civilian data recovery back in 1985: artificial intelligence that can fabricate images, videos, and audio recordings so convincing that even experts can be fooled. Welcome to the era of deepfakes, and trust me, it’s already changing how courts handle digital evidence.

What We’re Up Against

Let me paint you a picture of where we are right now. AI-generated content has moved from research labs to consumer smartphones. Anyone with a decent app can now:

– Swap faces in videos with frightening accuracy

– Clone voices from just a few seconds of sample audio

– Generate entirely synthetic images of people who don’t exist … and of those who do.

– Alter existing footage in ways that leave minimal technical traces

I’ve examined cases where manipulated video evidence looked so authentic that initial reviewers accepted it without question. The technology has democratized deception in ways we’ve never seen before.

The Authentication Crisis

Here’s what keeps me up at night: our traditional methods of authenticating digital evidence are struggling to keep pace.

For decades, we’ve relied on metadata analysis, file structure examination, and chain of custody documentation. Those tools still matter, but in many cases, they’re no longer enough. When AI can generate a video from scratch—complete with realistic metadata, proper codec structures, and no obvious manipulation artifacts—we need a fundamentally different approach.

The challenge isn’t just technical. It’s philosophical. We’re moving from a world where we asked “Has this been altered?” to one where we must ask “Is this even real to begin with?”

The Metadata Problem

In traditional forensics – and most of the time even now – metadata has been our friend. Creation dates, device identifiers, GPS coordinates—these data points help us verify authenticity and establish provenance. But AI-generated content can include perfectly plausible metadata that’s entirely fabricated.

The “No Negative” Dilemma

Back in the day, photos had negative. Even in modern (digital) photography, there’s usually a kind of “negative”—an original file that shows a clear progression from capture to final image. With AI generation, there is no negative. The content springs into existence fully formed. How do you authenticate something that has no original?

What Courts Are Starting to Do

The good news? Courts are waking up to this challenge, and we’re seeing some interesting responses.

Enhanced Authentication Standards

Federal jurisdictions are raising the bar for digital evidence authentication. In June, 2025, the Judicial Conference of the US’s Committee on Rules of Practice and Procedure approved Federal Rule of Evidence 707, that ensures that AI-derived evidence is subject to the same Daubert standards as traditional expert testimony.

A judge might require the expert to run multiple AI detection algorithms on submitted video evidence—not because there was any specific reason to doubt it, but because the stakes were high enough to warrant extra scrutiny.

Blockchain and Cryptographic Verification

Courts are also showing increased interest in cryptographic authentication methods. Some organizations are now implementing systems that create cryptographic signatures at the moment of capture—essentially a digital seal that proves when and where content was created.

The Content Authenticity Initiative (backed by Adobe, Microsoft, public media, camera manufacturers, and others) is pushing standards for embedding authentication data directly into digital files. While not yet widely adopted in legal contexts, even in its sixth year, attorneys ask about these tools more frequently.

Expert Testimony Evolution

The role of digital forensics experts is expanding. It’s no longer enough to say “I examined this file and found no signs of manipulation.” Now we’re being asked:

What is the probability this content is AI-generated?

– Can you rule out deepfake creation methods?

– What authentication measures were in place at capture?

– Are there any positive indicators of authenticity beyond the absence of manipulation?

That last question is crucial. We’re moving from negative verification (looking for signs of tampering) to positive verification (finding affirmative proof of authenticity).

The Detection Arms Race

Here’s the uncomfortable truth: detection is always playing catch-up … and the law is yet is almost always further behind. By the time we develop tools to identify one generation of AI-generated content, the next generation is already better at evading detection.

I use multiple AI detection tools in my practice—everything from Microsoft’s Video Authenticator to various academic research tools. They’re helpful, but they’re not foolproof. Detection accuracy varies wildly depending on the generation method, content type, and how much post-processing has been applied.

What Actually Works

In my experience, the most reliable authentication approaches combine multiple layers:

**Technical analysis**: Running the content through various detection algorithms and looking for statistical anomalies that suggest AI generation.

**Contextual verification**: Examining the chain of custody, device provenance, and whether the content’s existence makes sense given the circumstances.

**Comparative analysis**: Looking for consistency across multiple pieces of evidence. If someone has ten photos from an event and one looks AI-generated, that’s a red flag.

**Behavioral indicators**: Sometimes the content itself reveals impossibilities—lighting that doesn’t match the environment, shadows that fall the wrong direction, or subtle physics violations that our brains recognize even if we can’t articulate why something looks “off.”

Best Practices for Attorneys

If you’re handling cases with digital evidence (and let’s face it, what case doesn’t have digital evidence these days?), here’s what you need to know:

**Get evidence authenticated early.** Don’t wait until trial to discover your key video evidence might be AI-generated. Have it examined during discovery.

**Document the chain of custody meticulously.** With deepfakes, provenance matters more than ever. Know where the evidence came from and every hand it passed through.

**Preserve the original files.**  Maintain the original files in their native format with all metadata intact.

**Consider protective orders.** If you’re worried about evidence being used to create convincing fakes, seek protective orders limiting how digital evidence can be used or distributed.

**Budget for expert analysis.** Authenticating digital evidence in the age of AI isn’t cheap, but it’s a lot less expensive than losing a case because you relied on fabricated evidence.

Looking Ahead

This problem is going to get worse before it gets better. AI generation capabilities are improving faster than detection methods. Within a few years, we’ll likely face synthetic evidence that’s indistinguishable from authentic content using current detection methods.

But I’m not entirely pessimistic. The legal system has adapted to technological challenges before—from fingerprinting to DNA analysis to digital forensics itself. We’ll adapt to this too. And the tools are also improving fairly fast – sometimes with the help of AI itself.

The key is recognizing that we’re in a transition period. The old rules still apply, but they’re no longer sufficient. (But isn’t that always the case?) Courts are developing new standards, forensic methods are evolving, and the legal community is taking this threat seriously.

The Bottom Line

If there’s one thing I want you to take away from this article, it’s this: question everything. That advice has always been good practice in digital forensics, but now it’s absolutely essential.

Don’t assume video evidence is authentic because it looks convincing. Don’t trust audio recordings without verification. Don’t accept digital evidence at face value, no matter how legitimate it appears.

The technology to fabricate convincing digital evidence is here, it’s accessible, and it’s being used. Whether you’re prosecuting, defending, or presiding over cases, you need to understand this landscape and demand rigorous authentication of digital evidence.

Because in 2026, seeing—or hearing—is no longer believing. And that changes everything.

*Steve Burgess is a digital forensics expert with over 40 years of experience and has worked on more than 20,000 cases. Burgess Forensics has been serving attorneys with digital evidence analysis since 1984. If you have questions about authenticating digital evidence in your cases, we’re here to help.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Deepfakes, AI, and the New Frontier of Digital Evidence appeared first on Burgess Forensics.

Top 5 Mistakes Lawyers Make With Digital Evidence  –      Copyright 2026, Steve Burgess

After forty years working with attorneys on digital evidence, I’ve seen the same mistakes cost cases time and again. Here are five of the most common – and how to avoid them.

Mistake #1: Waiting Too Long to Preserve Evidence

Digital evidence disappears. Every time someone uses a device, it writes over old data. Even just turning a computer, tablet, or phone on writes new data and can irretrievably overwrite important logs and other files. Cloud accounts purge. Phones get reset. Employees leave with their devices.

In one employment case, an attorney contacted me three weeks after filing. By then, IT had wiped the defendant’s laptop and reassigned it. Emails, browsing history – all gone. The case settled for pennies.

What to do? Send a preservation letter immediately – before you file, if possible. Be specific: phones, computers, cloud accounts, backup drives. Then follow up. If they drag their feet, file for a preservation order.

Mistake #2: Letting Your Client Handle the Evidence

Your clients mean well. They forward screenshots, print text messages, save files to thumb drives. But every time they touch that evidence, they change it. Metadata gets altered. Timestamps shift. Valuable metadata disappears when a file gets saved for you as a PDF.

I worked a family law case where a mother scanned threatening texts from her ex-husband as PDFs. The texts were real, but the metadata showed they were created the day before the hearing. The judge excluded them. She lost custody. A forensic extraction would have authenticated those messages in five minutes.

Don’t let clients collect their own evidence. Bring in a forensic expert early to properly image devices with full chain of custody. It costs a fraction of what you’ll lose if evidence gets excluded.

Mistake #3: Relying on Screenshots

Screenshots are convenient and visual. But from a forensic perspective, they’re basically worthless as evidence.

A screenshot is just a picture. It doesn’t prove when something was created, who created it, or whether it’s altered. Anyone with photo editing software can fake one in seconds.

In one business fraud case, an attorney submitted Slack screenshots as his centerpiece evidence. The defense expert showed the timestamps didn’t match, the formatting was off, and the metadata was wrong. Screenshots excluded. Case collapsed. The screenshots were real – but without authentication, useless.

Get actual data from the source. Forensically image the phone, the computer, or the flash drive. Subpoena the platform. Capture the full metadata. Screenshots can illustrate a point, but they can’t prove it.

Mistake #4: Ignoring the Metadata

Metadata is the hidden information in every file – creation dates, edit times, GPS coordinates, device identifiers. It’s the DNA of digital evidence.

Many lawyers ignore it or don’t know how to read it. That’s a problem, because metadata often tells a different story than the file itself.

In one contract dispute, the plaintiff submitted a PDF agreement dated March 15. The defendant’s expert checked the metadata and found it was actually created April 3 – two weeks after the claimed signing date. It had also been edited on April 5. Case dismissed.

Always check metadata before relying on digital files. If you don’t know how to read it, hire someone who does.

Mistake #5: Calling the Expert Too Late

Most attorneys call me when they’re already in trouble – evidence deleted, authenticity challenged, judge threatening sanctions. By then, it’s often too late.

I worked with an attorney who gathered evidence for six months on his own. When he finally brought me in before trial, we discovered half the “evidence” was inadmissible. Broken chain of custody. Altered metadata. No authentication. The case settled for much less than it should have.

A forensic expert can identify what evidence exists, preserve data properly, authenticate documents for court, and testify to methodology under FRCP’s Rule 702. Early involvement doesn’t just protect your evidence – it strengthens your entire case.

The Takeaway

Treat digital evidence like physical evidence. You wouldn’t let your client collect their own blood samples. The same goes for phones, computers, emails, and cloud-based data.

Preserve early. Don’t let clients handle evidence. Get actual data, not screenshots. Check metadata. Involve an expert before trouble hits.

Your case will thank you.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Top 5 Mistakes Lawyers Make With Digital Evidence appeared first on Burgess Forensics.