You’ve seen the movie. The defense expert pats the last hair into its slicked place, adjusts his tie, and strolls confidently to the stand, with what he believes is a knowing smile on his face. Then the prosecutor asks a sharp question and the smile crumbles.

Real life is less cinematic. The digital forensics expert often never reaches the witness stand at all. Instead, his report does the talking. It lands on the prosecutor’s desk, shapes the plea discussion, and sometimes ends the case – one way or the other –  before a jury is ever seated. The evidence doesn’t know who hired him, and digital “smoking guns” have a way of melting once someone looks under the hood.

When a client is facing cyberstalking or digital harassment charges, the prosecution’s case often arrives neatly packaged as a PDF of text message screenshots, a carrier call log, a few scans of filled-n forms, or a printed report from a mobile extraction tool.

To an aggressive defense attorney, that report shouldn’t look open and shut, no matter how it’s written. It should look like an invitation to start asking hard questions.

1. The “Shared Device and IP” Fallacy

A text message, an IP address, or a home Wi-Fi network is not a person. A common pitfall in digital harassment cases is assuming that because a message originated from an IP address or a device tied to a defendant, that specific defendant was behind the keyboard.  

• Shared Households and Open Networks: Family members, roommates, or visiting guests or half a dozen teenagers at a gaming party in the basement, may all be on the same Wi-Fi, and to the outside world, they share a single IP address.
• Compromised Accounts & Spoofed Headers: Malware, session hijacking, or spoofed identifiers can make it look like a device sent data it never touched. Without rigorous forensic attribution, such as physical proximity logs, biometric sign-ins, or physical keystroke analysis, an IP address is just a location, not a confession.

2. Context, Venting, and the Intent Gap

Prosecutors love to highlight the most inflammatory text messages out of context. But a raw chat log strips away the rhythm of a conversation.

• Was the message an isolated outburst during a bitter custody dispute, or part of an obsessive, calculated campaign?
• Is it clumsy, offensive venting, or does it meet the strict statutory threshold for a targeted, credible threat? Defense forensic work often involves reconstructing the entire communication history, including deleted messages, previous threads, and mutual exchanges. They want to show the true context of the interaction and challenge the alleged “course of conduct.”

3. The Report Nobody Can Read

Extraction reports from tools like Cellebrite and Magnet AXIOM can come in a couple of flavors, and both can be a problem.

Some are enormous. Thousands of pages of call logs, app databases, Wi-Fi connections, cached images, and system entries with names only an examiner could love. The few items that matter are in there somewhere, buried under everything else the phone ever recorded. Many attorneys open one, turn a few pages, and quietly close it again. That’s understandable. Too many clients,  too many pages, and a family they want to get home to sometime today. It’s also how important context gets missed.

Others are thin. A few dozen pages, cherry-picked down to the messages and records that support the charges. But a selection is not the whole phone, and what was left out may matter as much as what was kept.

Either way, ask for the full extraction in its native reviewable format, not just the PDF. Cellebrite’s Reader and AXIOM’s Portable Case let a defense examiner search, filter, and verify everything the tool captured, including what never made the printout.

4. Challenging the Extraction and the Chain of Custody

Digital evidence is fragile. If law enforcement used an unvalidated tool, failed to maintain proper hashing during acquisition, or searched a seized device outside the explicit scope of a search warrant, the digital trail loses its integrity. Furthermore, third-party cloud data or ephemeral messaging apps (like WhatsApp, Signal, or Snapchat) can leave conflicting timestamps across devices due to sync delays, server backups, and local timezone mismatches.

And a timestamp doesn’t always mean what it seems to. A file’s “created” date usually records when that copy landed on the device, not when the photo was taken or the document was written. A picture shot in 2019 and texted to someone last week may show a creation date of last week on the recipient’s phone. It’s less like a postmark and more like the “received” stamp on a letter. Which date the report shows, and what that date actually measures, can change the whole timeline.

What This Means for Defense Counsel

If you are defending a cyberstalking or digital harassment case, never take a prosecutor’s printout of digital communications at face value. I wouldn’t jump straight to assuming something was hidden on purpose, either. Often it simply wasn’t asked for. Cut them a break: prosecutors carry heavy caseloads too, and nobody thinks of everything. There may be something they didn’t think to ask for that you can. And a clean PDF export can’t show you the metadata, the sync artifacts, or the gaps in the timeline.

The data is the data, and it often tells a very different story once you examine the underlying extraction files.

Have you ever had a digital evidence trail completely unravel under forensic review? I’d like to hear about your courtroom experiences with electronic evidence.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post The Printout Isn’t the Proof: Digital Evidence for Criminal Defense Counsel appeared first on Burgess Forensics.

If you scan the criminal dockets for cases involving cyberstalking, you will notice a persistent pattern. Cyberstalking is rarely the main course. More often than not, it’s just the side dish. It gets tacked onto a primary indictment for domestic violence, extortion, federal wire fraud, witness tampering, or physical assault. On its own, prosecutors routinely treat standalone cyberstalking as too elusive, too resource-intensive, or too easy for defense counsel to poke holes in.

That gives rise to an interesting question for legal practitioners: why is digital harassment so frequently relegated to an “add-on” charge, and what happens when the digital trail is all you have?

Why Standalone Charges Fall Flat

To understand why prosecutors hesitate to bring pure digital stalking cases to trial, you have to look at the practical and evidentiary hurdles that hit the prosecution at intake.

The Attribution Trap: Proving who typed the message beyond a reasonable doubt is still one of the toughest burdens in digital forensics. VPNs, burner phone apps, compromised accounts, and spoofed IP headers leave enough digital shadow to create reasonable doubt if a prosecutor doesn’t have a physical predicate act, like a traffic stop, a seized phone, or a ring camera feed, to anchor the keyboard to a specific set of hands.

Ambiguity of Intent: Digital harassment lives in the grey zone between constitutionally protected speech and criminal threats. Historically, to sustain a charge without infringing on free speech, many statutes required proving a “credible threat” of death or serious bodily harm. To make that point a bit more clearly, “You’re gonna get it!” isn’t likely to be considered a credible threat, whereas “Imma stab you in the eye tomorrow.” would certainly be. Unrelenting, malicious digital harassment that falls just short of an explicit physical threat often left prosecutors without a clear statutory hook.

Plea Bargaining & Resource Constraints: Digital forensics takes time, chain-of-custody documentation, and validated tool outputs that don’t fit neatly into a fast-moving misdemeanor docket. When cases do get charged, standalone digital counts are frequently the first bargaining chips dropped or pled down to simple harassment or disorderly conduct.

Before we go blaming law enforcement for cherry-picking, consider that cyberstalking doesn’t leave the kind of evidence prosecutors are used to (at least, so far). An assault leaves a black eye, bruises, broken bones. A burglary leaves an empty space (possibly the only non-dusty spot) where a stolen item used to be, an embezzler’s work shows up in missing dollars.

The harm – and often the point – is fear, anxiety, and a life rearranged around avoiding someone, none of which photographs very well. The evidence is spread across phones, laptops, social media accounts, email providers, and carrier records, much of it held by third parties who release it only under subpoena or warrant, and some of it gone before anyone thinks to ask. 

The Ground Is Shifting Under the Statutes

While that historical pattern remains true today, the legal and technical landscape is actively evolving. State legislatures and federal prosecutors are adjusting to modern reality, expanding how the law defines course of conduct.

Lowering the “physical threat” bar can result in more prosecutions for different types of harm. Newer statutory models are shifting focus from requiring a fear of physical injury to demonstrating substantial emotional distress or economic harm. This allows prosecutors to pursue standalone charges in severe cases involving doxing, non-consensual image sharing, or orchestrated online mobbing campaigns.

Lawmakers have begun targeting the tools, not just the threats. Legislators are increasingly criminalizing the underlying technology itself. Banning unauthorized GPS/AirTag tracking, stalkerware deployment, and automated mass-messaging tools gives prosecutors discrete, objective physical actions to charge, turning the act of digital surveillance itself into a substantive crime.

Federal Stalking Statutes are being amended and adjusted. The Department of Justice is increasingly utilizing 18 U.S.C. § 2261A to bring standalone federal charges when interstate digital harassment is structured, persistent, and well-documented.

What This Means for Litigators

Whether you handle criminal defense, prosecution, or civil restraining orders (where standalone digital evidence has long been king), the takeaway is simple: the threshold for what constitutes an actionable digital course of conduct is expanding.

In practice, a case rarely hinges on a single smoking-gun text. It hinges on the pattern: login timestamps matching access logs, device sync artifacts, metadata from cross-platform messaging, and correlation between IP hops and known geographic locations.

The laws are changing to meet the reality of modern harassment. The question is whether the digital evidence you are looking at supports a standalone narrative or merely an afterthought.

Have you seen cyberstalking charges brought as a primary count in your jurisdiction, or is it still mostly an add-on to physical claims? I’d like to hear what you’re seeing in the courtroom.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When Cyberstalking Is Just an “Add-On” Charge (And Why That’s Changing) appeared first on Burgess Forensics.

Your next custodian might not have an inbox, a job title, strong feelings about the office thermostat, or about someone nuking last night’s salmon in the microwave.

It might have API access. For the uninitiated, an API is a way for software systems to communicate and request actions from one another.  Think of it as a pal you gave a key to so they could feed the cat while you’re away. They can come in and use the can opener. They are not supposed to go through the medicine cabinet. The logs may help you work out which metaphorical rooms they visited, if anyone enabled the logging.

That should give anyone who drafts litigation holds a moment’s pause.

Two recent pieces in the news caught my attention. Ralph Losey’s August EDRM article, “When AI Agents Go Rogue, the Logs Become Evidence,” looks at the trail an agent leaves as it works across systems: commands, messages, access records, and the technical context around them. K&L Gates’ May 20 Litigation Minute comes at it from the preservation side. GenAI prompts, outputs, uploaded documents, and usage logs may fall within preservation obligations, and they may not be retained by default. Some disappear on a schedule. Others never exist at all unless someone turned on logging before anyone needed it.

Put the two together and you land on an uncomfortable question: does your client’s litigation hold reach the systems that are doing the work?

Isn’t this just the chatbot-history problem again?

Not quite. We’ve previously discussed chatbots as diaries. Somebody types something candid into a chat window, and months later opposing counsel finds it very interesting. A neat way to manufacture an exhibit!

Agents are different because they act. Give one a task and permission, and it may search repositories, pull files, call tools, change records, send messages, or hand the job off to another agent. Depending on the setup, each of those steps can leave records in a different system.

The human’s chat history is one chapter. What the agent wrote is part two.

What does that look like in a real dispute?

Picture a hypothetical procurement agent told to cut spending with a supplier. It reviews the contracts, pulls purchasing data, updates the vendor record, and drafts a termination notice. A manager approves the notice. Six months later, the supplier sues.

You preserve the manager’s email and the final letter. Good start.

Now suppose the case turns on whether the company considered an amendment guaranteeing minimum purchases. Did the agent retrieve it? Did a tool call fail? Was the workflow working from an outdated version? Did the manager see a warning before clicking approve?

The polished letter may tell you very little about how any of that happened. You might think the polish reflects enough light on the subject, but there’s more in deeper, possibly darker, places.

The answers, if they exist, sit in retrieval records, tool responses, approval events, and application logs that nobody put on the collection plan. The manager may remember clicking “approve” and not much else. That isn’t evasion, it may just be delegation.

So is the software a custodian now?

As a working concept, yes, and a useful one. Calling the agent a custodian forces two questions: where is the machine’s work recorded, and who can preserve it? It does not give software legal personhood or put it in a deposition chair. (Although I would pay to watch someone instruct an agent to answer only the question asked.)

Some accountable human should own the workflow, control the settings, and manage the vendor relationship. That person belongs in the preservation conversation, and that conversation needs specifics. Name the tools and workflows that touched the matter. Identify the accounts involved, human and service. Find out what records exist, where they live, and when they expire. Then test that preservation works, because a beautifully drafted hold notice doesn’t necessarily touch automated deletion.

Can’t we just take the agent’s word for what it did?

Um, no, it’s an AI. An agent’s report that it finished a task is a record of what it claimed; it doesn’t prove the task was completed. In our procurement example, “I reviewed all relevant agreements” should send someone looking for the retrieval and access logs that could help verify it. That ever-confident AI statement is not a timestamp.

And by the way, this cuts both ways. The same logs that might reveal a skipped amendment might also show the agent did what it said it did.

Does this mean keeping every machine event forever?

No. Discovery still turns on relevance, proportionality, and privilege. Rule 26 did not acquire an unlimited-storage exception because someone said “agentic.”

Nor does a missing log automatically mean sanctions. In federal court, Rule 37(e) asks, among other things, whether reasonable steps were taken to preserve the information, whether it can be restored or replaced, and whether prejudice or an intent to deprive supports a particular remedy. State rules vary, and how courts will apply all of this to agent logs is still being worked out. That part is your department, not mine. I know, I say this all the time, but it’s true.

So, what to do?

Get curious earlier. At intake, alongside “Who was involved?” ask “What automated systems acted on this?” In custodian interviews, have people walk through the workflow step by step, including the steps they delegated and then never actually saw.

That will tell you more than asking whether they “use AI,” which can mean anything from fixing a comma to letting software negotiate with a supplier.

Your client’s copilots and agents may hold part of the factual record. Find it while it still exists.

Has an automated system turned up in one of your matters yet, either as a source of evidence or as a gap in it? I’d like to hear how it went.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When the AI Is a Custodian appeared first on Burgess Forensics.

We have spent years teaching computers to answer our questions, although sometimes it is the other way around. Now we are teaching them to spend our money. The first time an AI shopping agent orders the wrong shoes, nobody will call a lawyer, but the first time it orders 4,000 of them for a company, somebody will.This isn’t just a mental exercise. In September, Amazon blocked Meta’s Muse agent from shopping on its platform, citing a lack of authorization, an agent that didn’t identify itself, and the handling of customer credentials. Amazon has also blocked some agents from OpenAI and Google. Banks have separately warned that shopping agents may buy the wrong product, exceed a budget, steer customers toward weaker payment protections, or expose them to scams and fraud.

That raises a deceptively simple question: When the bot clicks “Buy,” who agreed to the contract?

The short answer is usually the person or company that deployed, authorized, or controlled the bot—not the bot itself. But the short answer rarely ends the argument. The longer answer, which is the one that could generate billable hours, is whether the bot acted within the authority it was given.

The federal E-SIGN Act provides that a contract involving interstate or foreign commerce cannot be denied legal effect, validity, or enforceability solely because its formation involved one or more electronic agents, so long as the agent’s action is legally attributable to the person to be bound. E-SIGN removes the electronic-agent objection; it does not itself establish agency, assent, scope of authority, or compliance with other applicable law. 15 U.S.C. § 7001(h).  State law may matter as well, including state enactments of the Uniform Electronic Transactions Act (UETA), whose § 14 addresses automated transactions.

So the fact that no human physically clicked the button does not automatically make the transaction disappear. We crossed that bridge years ago with automated ordering systems. Today’s bots are just crossing it with your credit card in their (virtual) hands.

The harder issue is authorization.

Suppose a client tells an agent, “Find me a laptop under $1,500 with at least 32 gigabytes of memory,” and the agent buys one for $1,425. That looks comfortably authorized. Now suppose it buys a $2,300 laptop because it decides the improved processor is “worth the investment.” Helpful initiative, perhaps. Also a decent opening paragraph for a complaint.

Agency principles will matter. What authority did the user actually grant? What limits appeared in the prompt, account settings, purchasing policy, or platform terms? Did the user authorize the transaction itself? Did the merchant’s terms allow this type of automated or third-party access? Did the agent have authority to manifest assent to the merchant’s terms on the user’s behalf? And did the merchant have reason to know that the agent was operating outside its instructions?

These disputes will be won or lost on the digital record, and much of that record is logs.

Attorneys should stop thinking of the receipt as the complete record. It’s not a piece of paper in your pocket. The relevant evidence may include the user’s original prompt and follow-up instructions; spending limits and product filters; whatever agent action history exists, tool-call logs, audit trails, and system events; model and software versions; authentication records; cart changes; confirmation screens; and the merchant’s server logs.

Collect it early. AI systems and their vendors do not necessarily retain every step indefinitely. A clean-looking final confirmation can conceal ten earlier decisions, three rejected products, a changed budget, and one hallucinated free-shipping offer. Hallucinated by the bot, that is.

Then there is the chargeback problem. Consumers may assume that “the AI did it” means “unauthorized.” Card issuers and banks may see a more complicated record. A purchase made through credentials deliberately supplied to an agent is not automatically equivalent to a stolen-card transaction. Whether a customer has a chargeback right, an error-resolution claim, or some other remedy may depend on the payment method, the issuer’s and network’s rules, the authentication record, the instructions given to the agent, the merchant’s conduct, and whether the agent made an unauthorized purchase or merely made an authorized purchase badly.

In other words, buyer’s remorse does not become a stolen-card case just because software was involved.

Fraud and privacy add another layer. A shopping agent may see card details, purchase history, addresses, brand preferences, and perhaps the contents of an email account or calendar. A compromised agent could make an unauthorized purchase. A perfectly functioning agent could also be manipulated by a fraudulent listing, a poisoned recommendation, or a merchant designed to look legitimate to software rather than to a human.

For attorneys advising businesses, now is the time to ask practical questions. Are agent-made purchases permitted? Is human approval required above a stated amount? Are transaction logs preserved? Can the system explain which instruction caused it to choose a product? Can the agent accept arbitration clauses, subscriptions, or recurring charges? And who receives the alert when it gets creative?

Like agency law, consumer protection, and the rules of evidence, contract law isn’t going anywhere. It just has a new participant: one that works quickly, reads terms instantly, and has never once felt the healthy hesitation that comes from entering a credit-card number. Has it ever felt anything?

The bot may have clicked “Buy.” The case may turn on who told it that it could.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post Your Client’s Shopping Bot Clicked “Buy.” Who (or What) Made the Contract? appeared first on Burgess Forensics.

Deleting the messages was the cheap part.

I recently wrote about sanctions: the adverse-inference instruction, the spoliation finding, the judge with disapproval written all over his face telling the jury it may assume the worst about whatever got erased. That’s a high price to pay for hitting delete. It can cost real money, and sometimes much more. Sometimes it ends up costing the whole case. But the courtroom is not necessarily where the biggest bills come due.

Regulators send a different kind of invoice, and they can send a lot of them.

The three-billion-dollar housekeeping problem

Since December 2021, the SEC and the CFTC have been running a sweep, collecting what they politely call “off-channel communications.” Translation: business talk that happened on personal phones, in texts, in WhatsApp, in Signal, in whatever app someone reached for instead of the monitored work system. The firms were supposed to keep those records. They didn’t. So, the messages weren’t there when the regulators came looking. Toll calls, indeed.

The tab so far is north of $3 billion in combined penalties across more than 100 firms. It started small and almost quaint: JPMorgan, December 2021, a $125 million (okay, not so small to you and me) WhatsApp recordkeeping fine that looked at the time like a warning shot. It wasn’t a warning shot – it was just the opening bid.

And here’s the part attorneys may want to pay close attention to. The enforcement that hit the institutions is now working its way down to individuals. FINRA has picked up the baton and started suspending individual brokers for the same conduct. It’s been often said that all business is personal, but they didn’t mean penalties. Those corporate penalties are becoming personal. That text you fired off from your own phone doesn’t just belong to your employer’s compliance headache anymore.

One fine, for the deletion alone

Now a hop across the pond to Brussels for a clean illustration of the principle in Europe.

In June 2024 the European Commission fined International Flavors & Fragrances €15.9 million for obstructing an antitrust inspection. The underlying investigation into the fragrance industry is a separate matter and is still open as of IFF’s June 2026 filing. What earned the fine was this: during a 2023 dawn raid, while the Commission was reviewing employees’ mobile phones, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was underway.

Very bad timing. Not before. He deleted them after being told an inspection was happening.

It was the first time the Commission ever fined a company for deleting messages off a phone. And note the arithmetic, because it’s the whole thesis of this piece: the fine was set as a percentage of IFF’s total worldwide turnover, then cut in half because the company owned up and helped recover the data. The fine did not depend on proving that the messages established the suspected antitrust violation. The deletion itself was the offense.

“But the messages are gone. How do they even know?”

This is the question many ask, usually with real hope in their voice. It rests on the myth that a deleted message is a deleted event.

It isn’t. A message is not a single object sitting in one place. It’s an event that leaves marks in several places at once, most of them outside the sender’s reach.

Delete a text and the content may vanish from the handset (although it might also be recoverable from there), but the carrier may still maintain transaction records for an SMS or MMS, logging that a message moved from one number to another at a particular minute. That metadata won’t tell anyone what was said but it will tell an investigator that something was said, to whom, and when, and that is often more than enough. For encrypted apps that don’t use the carrier’s messaging service, evidence may exist elsewhere: in an enabled backup, in forensic remnants that may still be recoverable from the device, or on the other person’s phone.

That last one is the reversal worth dwelling on. In my usual line of work, “we have the logs” is what my side says when we’ve preserved the evidence, and the other side is squirming. In these cases it’s turned around. The logs that sink you are the ones the other side kept. Two firms message off-channel; one of them preserved its half of the conversation, and now the gap on the second firm’s system isn’t just a gap, it’s a documented absence with a matching record on the far end. The counterparty becomes the witness. In the fragrance case, the Commission caught the deletion during the raid and the deleted data was recovered through the backup system anyway. The employee erased his handset copy. He did not erase IFF’s backup.

Existence outlives content. That’s the line to remember. Should be the title of a book.

“Isn’t a fine just the cost of doing business?”

Some firms clearly treated the recordkeeping rules that way, right up until the number had ten figures in it. But there’s a subtler trap. When the deletion itself becomes the sanctionable act, the cooperation math changes. IFF’s fine got halved for coming clean and helping recover the data. The deletion still cost them eight figures. Without that cooperation, the Commission’s starting figure was twice as high. There’s no version of that ledger where hitting delete comes out ahead.

“My client isn’t a Wall Street bank or a fragrance conglomerate.”

Well, of course it’s not. But the logic doesn’t live in securities law or EU competition rules. It lives in one idea that runs through all of it: destroying evidence after you’re on notice is a separate wrong from whatever the evidence would have shown, and it carries its own separate price. Regulators call it obstruction. Judges call it spoliation. The custodian who cleaned up their phone the weekend after the litigation hold arrived is standing in the same spot as that senior employee in the fragrance case, minus the corporate turnover to cushion the landing.

So, what to do?

Nothing exotic. The unglamorous stuff, done early.

Preserve on notice. We know this goes without saying, but given that it’s still an issue, we’re saying it anyway. In U.S. civil litigation, the duty to preserve relevant evidence generally arises when litigation is reasonably foreseeable. If auto-delete settings can affect information in scope, suspend them.

Assume the other side kept their copy. Advise clients as though the counterparty preserved everything, because sometimes they did. A story that depends on a message never having existed is a story with a short shelf life. Hope and reality can be two very different things.

Preserve the phones before they’re “cleaned up.” Deleted-but-recoverable data may have a narrow window. It can disappear when the device is wiped, traded in, or overwritten through continued use or backup rotation. Phones also perform their own internal clean-up, so time matters. Preserve the device promptly, then have counsel and a qualified examiner determine the appropriate scope and acquisition method.

Don’t confuse encrypted with gone. Signal and similar apps can make content harder to recover, but encryption does not eliminate every potential source. Depending on the app and its settings, evidence may remain in an enabled backup, a screenshot, or a recipient’s device.

Deleting evidence can create consequences on several legal tracks. A court may impose remedies for spoliation, while a regulator may pursue recordkeeping violations or obstruction. Those categories can overlap, and the available penalties depend on the facts and the forum. What they share is that the deletion can become a problem of its own, apart from whatever the missing messages might have shown.

Ever had a “the messages are gone” case turn out to be nothing of the sort once you looked at the other side’s devices? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Sources: European Commission press release, IFF €15.9M (June 2024) · Holland & Knight, SEC/CFTC off-channel enforcement totals · Ex-Wells Fargo Broker Fined, Suspended for Off-Channel Texts to Colleague

The post Auto-Delete, Take Two: Regulatory Fines Can Dwarf Sanctions appeared first on Burgess Forensics.

The messages were set to delete within an hour, and some of those settings were changed after a litigation hold had already landed. That was really the whole idea.

If you practice long enough, you learn that the tools change but human nature doesn’t. Caveguy Ugg didn’t want anyone to know where he buried the mammoth haunch. Today the digging stick is a setting inside Signal, and the dirt is a “disappearing messages” timer. Same instinct, better encryption.

A million years post-Ugg, the same instinct turns up in the Delaware Court of Chancery. It’s a decision worth reading once, and worth repeating to a client twice.

Wait, isn’t the whole point of an encrypted app that the messages are gone?

Gone from the phone, maybe. Not gone from your obligations.

In In re World Wrestling Entertainment, Inc. Merger Litigation (Del. Ch., May 2026), Vice Chancellor Laster addressed exactly this. Senior people ran Signal with auto-delete turned on, after receiving litigation holds, several manually changed individual chats so messages would disappear in a little less than an hour. The court didn’t shrug. The court held that the first hold already reached Signal communications that overlapped with the potential deal. And even apart from the hold, it found that the duty to preserve sale-related evidence had arisen by August 31, 2022. That was months before the later sale-process hold. Sophisticated parties in that situation should reasonably have anticipated litigation.

The line worth taping to your monitor: litigation holds are not self-executing. Sending the memo, and even making sure they got it, is not the same as preserving the data. Somebody has to identify the relevant apps and devices, verify the settings, and actually disable the auto-deleted function.

So, what did it cost them?

The court didn’t reach for the biggest hammer. Rather than make a default judgment or give a blanket “assume the worst” instruction to a jury, it did something more surgical. It was arguably more dangerous for the sanctioned side: it presumed certain specific facts to be true and then shifted the burden, requiring the defense to overcome those presumptions by clear and convincing evidence rather than the usual preponderance. A bit of a switcheroo on the usual burden of proof ground floor.

Read that again if you litigate. The evidentiary floor moved. That’s not a slap on the wrist.

Now, I’m a forensic examiner, not a lawyer, and the doctrine here (when the duty attaches, what sanction fits) is your department, and it varies by jurisdiction. What I can tell you is the part that lives on my side of the table: how this actually plays out in the data.

Can’t your people just recover the deleted Signal messages?

Sometimes, but not always, and not the way Professor Google’s many advisors say. Here’s what’s real.

Disappearing-message apps are built to leave little behind, but “little” is not “nothing.” Copies and traces have a way of surviving in places people forget. A forensic acquisition or Signal backup made while the data still existed. The conversation on another participant’s or linked device where some data has survived. A screenshot somebody took. Notification artifacts preserved elsewhere. A message quoted in an email. Encryption is a strong lock on the message itself. It does nothing about the copies that already walked out the door and went for a jog.

But if the content is truly gone, the forensics may not bring back the words. This matters much for setting expectations with a client. What may be able to show is the activity on the device or app artifacts: that an app was installed, that auto-delete was switched on, that a timer was shortened at a telling moment. Note that we’re talking about what the device did, not who was holding it. Putting a specific person at the keyboard is a separate and much harder question. But in a spoliation fight, showing that a message was set to vanish, and when the setting changed, can matter as much as the words that vanished.

So, what to do?

If you represent the party with the duty, the practical steps are unglamorous and they work.

Identify the apps early. Ask, in plain language, what everyone messages on — not just email and texts. Signal, WhatsApp, Snapchat, Teams, the group chat nobody mentions.

Turn off disappearing settings the moment litigation is reasonably foreseeable, and confirm that preservation is actually occurring rather than trusting that the memo did the job.

Preserve any available backups, forensic images, and secondary devices before data rolls off or is overwritten. But don’t assume an ordinary phone backup contains Signal history—or that a Signal backup captured short-lived disappearing messages. It’s a good idea to collect that before today’s backup writes over yesterday’s.

Document your preservation, not just your hold. When someone later asks what you did, “we sent a notice” is a weaker answer than “we sent a notice and confirmed the settings on every device by this date.”

None of this requires a particular level of paranoia. It requires remembering that a message built to vanish can still leave a record of having been built to vanish.

Ever had a “disappearing” conversation turn out not to be the dead end everyone assumed? I’d like to hear how it surfaced.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post When “Auto-Delete” Becomes “Adverse Inference” appeared first on Burgess Forensics.

“It’s encrypted, so I guess we’re just out of luck.” I hear some version of that from attorneys and other clients more often than you’d think, usually said with a kind of resigned finality, as though the phone in evidence had sealed itself inside a block of concrete. Sometimes it’s true (well, not the part about the concrete). More often, it isn’t — and treating encryption as the end of the inquiry leaves evidence on the table that the other side may be perfectly happy to collect.

Here’s the thing worth understanding: encryption locks the front door. It rarely locks the windows, the copies, and the spare key under the mat.

Modern devices encrypt data at rest. When an iPhone or a current Android phone or a laptop running FileVault or BitLocker is powered off or locked, the data on it is scrambled and, without the key, is effectively unreadable. That part is real, and it’s strong – it’s real strong. But “the data on that specific device, while it is locked” is a much narrower thing than “the information you’re after,” and the gap between those two is where most access actually happens.

The passcode is the whole ballgame — and people are careless with it. Full-disk encryption is only as strong as the credential protecting it. People reuse passwords, write them on sticky notes, store them in a notes app, share them with a spouse or an assistant, or pick something guessable. When access to a device is lawfully available — through consent, a cooperating party, or a court order — the encryption stops being an obstacle the moment the passcode is in hand.

And by the way, the data usually lives in more than one place. This is the point often missed. A message exists on the sender’s phone and the recipient’s. When the message’ sender deleted it from their phone, it doesn’t do anything to the recipient’s copy of the message. Photos sync to iCloud or Google Photos. Documents sync to cloud storage. Phones back up to a computer or to the cloud, sometimes automatically, sometimes in a form far easier to access than the locked handset itself. The encrypted device in the evidence bag may be the hardest copy of the data to reach — and the least necessary, once you map where else that same information lives.

Cloud accounts are their own doorway. When the data has synced to a provider, the relevant credential may be an account password rather than a device passcode, and the legal path may be a subpoena or warrant to the provider rather than an attempt on the hardware. Different lock, different key, often a more productive one.

The law here is genuinely unsettled, and that’s your department, not mine. Whether a person can be compelled to disclose or enter a passcode touches the Fifth Amendment, and courts around the country have landed in different places on it — some applying a “foregone conclusion” rationale, others declining to. Compelled use of a fingerprint or face has its own tangled line of cases. I’m a forensic examiner, not a lawyer, and I won’t pretend the doctrine is settled when it plainly isn’t. But knowing that these avenues exist — and that they’re contested — is the difference between assuming a device is unreachable and asking the right questions about how it might lawfully be reached.

So what should you actually do? Stop treating “it’s encrypted” as the end of the road, as a verdict. Treat it as one locked door in a building with several entrances. Ask where else the data lives — the other party’s device, the cloud, a backup, a synced computer. Preserve all of it early, before someone decides to tidy up. And bring in a forensic examiner before you conclude anything is impossible, because what’s feasible depends heavily on the specific device, the operating system version, and how the data was stored — details that change constantly and that a competent examiner tracks for a living.

Encryption is a strong lock. It is not a force field. The attorneys who understand the difference get to the evidence; the ones who don’t talk themselves out of it.

Have you ever had a case when a locked or encrypted device in your case was or was not actually a dead end? I’d love to hear about it.

Don’t miss a single issue of our informative newsletter … Subscribe now

The post Encrypted Doesn’t Mean Untouchable: What Attorneys Should Know About Device Access appeared first on Burgess Forensics.

You thought you sent a one-page letter. What you actually sent was a one-page letter and a small pile of paperwork the letter filled out about itself when you weren’t looking.

That paperwork is metadata — data about data. And it travels with your files whether or not you invited it along for the trip.

Metadata is the stuff a document quietly jots down while you’re jotting down words. There’s a lot of potential information there: Who created it, when, and on what computer. Who edited it, and when they last saved it. Where a photo was taken, down to the GPS coordinates. What camera, what settings, what software. None of it shows up on the page. All of it comes along, like a stowaway.

Most of the time this is harmless, but occasionally, it’s the whole story.

A photo is a very talkative little file.

Take a picture with your phone and you’ve created a small autobiography. The image, surely, but tucked inside is a section called EXIF data: the make and model of the phone, the date and time down to the second, and, if location services were on, the exact spot on Earth where you stood. Share that photo in its original form and you may be handing over your home address without meaning to.

The good news: most social platforms started stripping this out a few years ago when there was a public hue and cry about it. The bad news: “most” is not “all,” and emailing the original file, or dropping it in a shared folder, sends the whole talkative package along.

Documents keep a diary too

A Word document remembers more than the final draft. Depending on your settings, it can carry the author’s name, the company the software was registered to, how long the file was open, and sometimes, a list of former edits and tracked changes and comments you thought you’d removed. Every “on second thought, delete that paragraph” can live on in the file’s memory.

The Internet is dotted with cautionary tales of press releases and legal filings that were sent out with the edits still readable underneath. The same is true with newsworthy congressional hearings. Most of us are not popular enough to warrant interest from the government. Still, the words on the page said one thing but the metadata said “here’s what we almost admitted.” Oopsie.

So, what to do?

There’s no need to get paranoid about this. Depending on what you’re shopping for, your grocery list is not a national secret. But a few practical habits go a long way:

• Before sending anything sensitive, look under the hood. In Word on Windows, “Inspect Document” should find and remove hidden data, comments, and tracked changes. Do it on the final version, not the draft.
• Turn off location tagging for your camera if you don’t need it — or scrub EXIF data from photos before sharing the originals. By the way, if litigation is foreseen that involves these photos, don’t scrub the EXIF metadata. It will be considered spoliation of data and will go poorly for you if and when it goes to court.
• Remember that “delete” inside a file often just means “hide.” Removing a comment from view is not always the same as removing it from the file.

None of this requires becoming a hermit. It’s the digital equivalent of checking your pockets before you send the coat to the cleaners.

Metadata isn’t sinister. It’s just honest — sometimes more honest than we’d like. The trick is knowing it’s there, so you decide what to share instead of the file deciding for you.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post The Metadata You Didn’t Know You Were Sending appeared first on Burgess Forensics.

The format language in a discovery request is easy to skip over. It looks like boilerplate. It reads like boilerplate. It is actually boilerplate. And so it gets waved through: “produce as PDF, that’s fine.” Maybe not so fine when that same attorney later pays me to explain why the file on my screen can’t answer the question the case now turns on.

Here’s the thing the other side already knows: whoever picks the format picks what you get to see. It’s just how the rules work. Under Federal Rule of Civil Procedure 34(b)(2)(E), the party asking for the documents gets to specify the form they arrive in. Don’t specify, and the choice falls to the producing side, with “reasonably usable” form as the only floor — and reasonably usable is a long way from native. Say nothing about format and you’ve handed them the pen.

Native files vs. PDFs sounds like an argument for the IT department, right? It isn’t. It’s one of the quietest, most consequential fights in the whole discovery process, and it’s worth having on purpose.

A PDF is a photograph of a document, not the document

A native file is the thing itself – the spreadsheet with its formulas still doing math, the email with its full routing header, the Word file that still remembers every draft, the photo that quietly wrote down where and when it was taken. I have a paragraph in my engagement letter saying so, albeit a bit more succinctly. A PDF or a TIFF is a picture of that file after someone chose the pose.

What really gets me is when evidence is produced as a printout of a PDF of a scan of a PDF created from the actual original file. Happens all the time. But it’s several steps away from what really happened and far from the metadata that tells the real story.

Such “pictures” drop exactly the parts that tend to win cases. Most of the metadata, describing fields such as who made it, when, on what device, and sometimes where tends to get lost when a PDF is generated from it. This is the difference between “he says he wrote it in March” and knowing, to the minute, that he didn’t.

A spreadsheet may show you a very precise value of 4,203,722.46 in the flattened PDF version but hides the formulae and structure that generated a possibly different number. A document that previously contained all the things people put in a document before they remembered other people would read the tracked changes, comments, hidden rows? Native format keeps them. The flattened copy forgets them, conveniently.

Hash values and container data are integrity signals that may let you and me confirm that the document produced is the same as the original are casualties of a PDF export. It snaps that verification thread and asks you to just take everybody’s word for it instead.

None of it comes back, either. You can’t un-flatten a PDF into the original any more than you can un-fry a flapjack. Once it’s produced that way, the missing data isn’t hiding from you. It’s gone.

I had a case where the “date digitized” EXIF metadata from a series of photos supported one side’s story. However, deeper in the metadata, there was satellite data that cast real doubt on the story being told. Satellites and their atomic clocks don’t lie about the time or the day.

Why the other side is so agreeable about it

Producing in PDF usually isn’t laziness. It’s control wearing the costume of laziness. A flattened production is easier to redact, easier to Bates-stamp, and, in a happy coincidence, easier to sanitize. The timestamp that wrecks the timeline, the author who wasn’t supposed to be within a mile of that memo, the formula that shows how a number really got built: all of it vanishes in the conversion, and it vanishes wearing the respectable coat of “routine document handling” rather than the orange jumpsuit of spoliation.

To be fair, imaged production isn’t always a dodge. Sometimes there are honest reasons for it — privilege review, redacting personal or protected information, or real proportionality under Rule 26(b)(1) when native would cost more than the whole dispute is worth. Those reasons are legitimate. The trick is to make the other side say so out loud, in the protocol, so that “we imaged it” has to be justified rather than simply assumed.

I should be clear that “save as PDF” is also a genuinely lousy way to strip metadata even when someone’s trying to be honest. It leaves things behind and takes things it shouldn’t. But that’s a different article. For today: the party that controls the format controls the evidence, and they know it even if your side doesn’t.

The fight is won in the ESI protocol, not in a motion six months later.

This is the part I most want attorneys to hear. By the time you’re standing in front of a judge complaining about a bad production, you’re asking to redo work the other side has every incentive to slow-walk into the next fiscal year — and you’re explaining to your client why the schedule, and the bill, went sideways. Nobody enjoys that conversation. Least of all the person who once said “PDF is fine.”

So specify the format on the front end, in writing:

• Ask for native formats, with metadata, by default for anything data-rich — spreadsheets, databases, structured exports — with load files that actually carry the field data. Boring to negotiate. Priceless to have.
• Name the metadata fields you want. Custodian, author, created and modified dates, an MD5 or SHA-1 hash, and parent/child relationships so attachments stay tied to their emails. “With metadata” is an invitation for the other side to read the phrase as generously as their conscience allows.
• Reserve the right to request native format for anything produced as an image, and say so up front — so when you invoke it, it’s a term of the deal and not an ambush they get to act wounded about.
• Bring your examiner in before the language is set, not after the production disappoints. Format specs written without technical input have a real talent for asking, very precisely, for the wrong thing.

The bottom line

This is not enhance-the-reflection-in-the-sunglasses forensics. It’s plumbing. It’s unglamorous, it’s easy to skip, and it is very often the only thing standing between evidence you can build a case on and a tidy picture of evidence you have to take on faith.

Courts increasingly expect native production where format carries meaning, and (hopefully) increasingly treat “well, we already gave you a PDF” as the weak answer it is. But you don’t drift there by luck. You get there by treating format as a substantive term of the case — argued with the same seriousness as scope and custodians, and about a thousand times more attention than it usually gets.

Have the fight early. It’s a great deal cheaper than the one you’ll have later, in front of a judge, with your client and their checkbook watching.

What’s the worst production-format surprise you’ve run into — native you wish you’d demanded, a PDF that turned out to be hiding the whole case, or something else entirely?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Native Files vs. PDFs: Why Discovery Format Fights Are Worth Having appeared first on Burgess Forensics.

Twenty years ago, a forensic report about a hard drive was mostly an argument about whether a file existed and when it was last touched. And of course, trying to recover deleted material. Today the same report might need to address whether a video is real, whether a document was generated by a language model, whether a “deleted” text message ever really existed on the device in the first place, and especially, whether the tool used to answer any of those questions is itself reliable enough to stand behind in front of a jury.

It doesn’t come up in every case, but when it does, we’d better be ready to answer. Digital forensics has always rested on the idea that a method can be explained, tested, and challenged — that’s pretty much the whole premise behind Daubert and Frye. AI-assisted analysis complicates that premise, because a growing number of detection and authentication tools now involve models whose internal reasoning isn’t fully visible even to the people who built them. Courts are already grappling with what that means for the right to confront the basis of evidence against you, and there isn’t yet a settled answer For instance, I’ve seen questions about whether Cellebrite might mis‑label a recovered file as‘deleted’ or treat an active file as if ithad been deleted, even though the platform is historically solid and time‑tested in most other respects. Still, that’s not a hypothetical academic question; it’s a live one working its way through appellate opinions right now and it’s going to shape how expert reports get written well into the future.

What’s changing on the ground, in the meantime, is the volume and variety of source data an expert has to account for. A phone used to mean call logs and texts. Now it means cloud-synced photo libraries, health data, smart-home integration logs, location history from a dozen apps that nobody remembers granting permission to (or maybe that an update changed the permissions you did or did not grant, and metadata trails that span devices the owner may not even still possess. The expert’s job isn’t just extraction anymore — it’s building a coherent, defensible narrative out of data that lives in more places than any one device.

The next several years will bring a few concrete shifts. Although there will certainly be changing laws for changing environments, standards bodies and courts will move, slowly and , toward requiring more explicit validation testimony for AI-assisted tools. Not just “the software said so,” but documented error rates, testing methodology, and version-specific behavior, the same rigor that’s long been expected of DNA analysis and toxicology. Authentication of video and audio is going to become its own specialized sub-field, distinct from general digital forensics, the

way arson investigation split off from general fire science. And attorneys are going to need to get comfortable asking experts pointed questions about tool provenance — not because they distrust the expert, but because opposing counsel increasingly will.

None of this replaces the fundamentals. A well-documented chain of custody still matters. So does a methodology that can be explained in plain English to twelve people, a judge, and possibly an attorney who’ve never heard of a hash value, and an expert willing to say plainly what the evidence does and doesn’t show — that hasn’t changed and I don’t expect it to. What’s changing is the amount of homework required to get there, and how much of that homework now involves tools that didn’t exist five years ago.I’d like to makethis the first in a short series looking at where this field is actually headed, drawing on conversations with people building the tools and writing the standards rather than just my own two cents.

If there’s a specific angle—AI detection reliability, Confrontation Clause questions, how courts are handling deepfake authentication—you’d like covered first, I’m glad to hear it. Trial lawyers and judges who live with these issues every day are exactly who I’m hoping to hear from, so please let me know.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Future of Expert Testimony in a Digital World appeared first on Burgess Forensics.