Your client didn’t leak anything on purpose. That’s usually how it goes. The confidential settlement number, the internal complaint about a coworker, the photo that was supposed to prove they were out of town — all of it can arrive at opposing counsel’s desk wrapped in a bow, because nobody thought to ask what was riding along with the file.

Metadata is the paperwork a document fills out about itself. Every photo carries a record of when and where it was taken, and often what device took it.Every Word document remembers who created it, who edited it, and sometimes what earlier drafts looked like — because “track changes” doesn’t always mean what people think it means. Every email carries routing information that shows exactly which server it passed through and when, which is a problem if someone’s story about when they “first learned” something doesn’t match the timestamps.

I’ve spent more hours than I’d like counting looking at metadata that a client’s own attorney didn’t know was there. A “final” contract whose revision history documented every negotiating position the client took before landing on the last one. A deposition exhibit — a screenshot, no less — whose EXIF data placed the photo three weeks earlier and 200 miles away from where the witness swore it was taken.

None of this requires opposing counsel to be Sam Spade. It requires them to right-click and select “Properties,” or open the file in a tool built for exactly this purpose. Metadata review is the price of admission in any competent discovery practice now, and if your side isn’t doing it, you can safely assume the other side is.

The fix isn’t complicated, but it does require actually doing it before production, not after a client calls you in a panic. Native files should be scrubbed of unnecessary metadata before they go out the door, using proper redaction and metadata-removal tools — not just “save as PDF” and hope for the best, because that conversion process is notoriously bad at actually stripping what needs stripping. Track changes and comments need to be resolved and cleared, not just hidden from the default view. Photos being produced as exhibits should have their embedded location and device data reviewed before anyone decides whether that data helps or hurts the case — because sometimes it helps. You don’t want to accidentally destroy evidence (or let your client do it accidentally on purpose) when you’re just trying to be tidy. Frankly, destroying evidence when litigation is anticipated is a very large no-no at which a judge may frown deeply – sometimes with sanctions.

The flip side of all this, of course, is that the same sloppiness that burns your client can work in your favor against the other side. A produced document with intact metadata is a gift. It tells you who really wrote it, when, and whether the “contemporaneous” memo was actually drafted three days after the fact. I’ve had more than one case where a “Created” timestamp that didn’t match anyone’s testimony blew the case open.

The broader point is that a document isn’t just what you can see on the screen. It’s a small forensic record of its own life, and that record travels with it whether anyone remembers to look or not. Attorneys who treat metadata review as a routine part of both production and receipt catch things that attorneys who don’t simply never see.

What’s the closest call you’ve had — metadata that almost went out the door, or metadata you caught on the other side that changed the case?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Metadata Your Client Is Accidentally Sending to Opposing Counsel appeared first on Burgess Forensics.

Digital Evidence 101: What Every Attorney Should Know Before Discovery 

Copyright 2026, Steve Burgess

I’ve sat across the table – or more recently, the Zoom – from a great many attorneys over the past forty years, and I’ve noticed a pattern. Litigators who can cross-examine a hostile witness into a confused puddle, who can recite the rules of evidence from memory, and who can spot a hearsay problem from across the courtroom will sometimes look at a hard drive the way the rest of us look at a tax form: with suspicion, mild dread, and the blessed hope that someone else will handle it.

That’s understandable. Law school doesn’t teach this, and it shouldn’t have to. Digital forensics is its own discipline, just as forensic accounting or medical examination are their own disciplines. But discovery in 2026 runs through digital data so thoroughly that a basic working knowledge isn’t optional anymore. So, let’s cover a few fundamentals – the things many attorneys wish they knew before the discovery clock started running.

Digital evidence is broader than most people think. It’s not just emails and the obvious files on a work computer. It’s text messages, cloud storage, app data, metadata, browser history, location information, IoT (Internet of Things) device logs, and increasingly, AI-generated or AI-assisted content. If a device touches the internet or stores information electronically, it’s a potential evidence source.

I often suggest that clients assume something may be discoverable until proven otherwise, rather than the reverse. That approach occasionally results in collecting more information than you need. The opposite approach occasionally results in explaining things to your client, or worse, to a judge.

Speaking of common misconceptions, let’s talk about deleted data. When a file is deleted on most systems, the data itself usually isn’t immediately erased. Instead, the space it occupied is marked as available for reuse. Until something else overwrites it, some or all of that information may remain recoverable.

That’s often good news. It’s also not a guarantee. How long that recovery window remains open depends on the device, operating system, storage technology, and how much the device has been used since the deletion occurred. Anyone who tells you with complete certainty, as many a client will, that deleted data is “definitely still there” or “definitely gone forever” without examining the device is hand-waving.

Metadata matters more than content sometimes. A document’s content tells you what it says. Its metadata can tell you who created it, when it was created, what software was used, and what happened to it along the way. I’ve seen metadata reveal that a supposedly contemporaneous document was actually created weeks after the event it purported to describe – not a footnote – it can sometimes be the whole case.

Chain of custody sounds like bureaucratic box-checking until you’ve seen a case turn on it. It exists because digital evidence, unlike a paper document, can be altered without leaving an obvious trace if it isn’t handled correctly. A device examined by someone without proper forensic methodology – even with the best intentions – can have its evidentiary value compromised.

This is why “I’ll just have my IT guy take a look” is a sentence that makes me wince every time I hear it. Your IT person may be excellent at fixing printers, managing servers, and keeping everyone connected to Wi-Fi. That’s a different skill set than preserving evidence for litigation. Nobody calls a forensic accountant to repair the office copier, either.

Timing changes everything. The earlier a forensic expert gets involved, the more options exist. Devices keep getting used. Cloud accounts keep syncing. Backups keep cycling and overwriting older versions. Evidence that’s recoverable today may not be recoverable in three months, and there’s rarely a reliable way to know in advance which evidence is on a fast clock and which isn’t. The cost of being wrong is usually much higher than the cost of an early consultation.

None of this requires you to become a forensic examiner yourself – that would be a strange use of your law degree, and frankly I’d be out of a job. What it does require is recognizing when a case has a digital evidence component – which, in 2026, is most of them – and bringing in the right expertise before discovery goes sideways.

The attorneys who get the best outcomes aren’t the ones who know the most about digital forensics. They’re the ones who know enough to ask the right questions at the right time.

What are some things you’ve learned about digital evidence the hard way?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Digital Evidence 101: What Every Attorney Should Know Before Discovery appeared first on Burgess Forensics.

Copyright 2026, Steve Burgess

Smartphones are the single richest source of digital evidence in most litigation today. Text messages, call logs, photos, location history, app data, deleted files — it’s all there, sitting in a device that fits in a shirt pocket. Or in that back pocket that’s covered with bling. You’d think that because phones are so ubiquitous and so central to how people communicate, attorneys and their clients would have developed good instincts about preserving them. You would be wrong, and I say that with forty years of forensic experience and genuine affection for the legal profession.

The mistakes I see aren’t necessarily the result of bad intentions. They’re the result of people not knowing what they don’t know — which, in digi

tal forensics, turns out to be quite a lot. Here are the three that do the most damage.

Mistake One: Letting the Client Keep Using the Phone.

This one is so common that I’ve stopped being surprised by it, though I haven’t stopped being pained. The moment litigation is reasonably anticipated, a litigation hold applies to that phone. What it does not do, unfortunately, is apply itself. Unless someone explicitly tells the client to stop using the device normally, they will continue using it norma

lly — deleting old messages to free up space, backing up and syncing, downloading updates, letting apps purge their caches — all of which can overwrite the very data that might have been recoverable. The phone doesn’t know there’s a lawsuit. It’s just doing its job..

Even using the phone abnormally, that is – at all – makes potentially important changes to data that

could be responsive, and can also make otherwise recoverable data gone from the planet.

The fix is straightforward but has to happen early: tell your client, in plain language, to stop deleting anything and to bring you the phone. Not a screenshot of the phone. The phone. Best to put it into airplane mode and then turn it off immediately. We’ll get to screenshots in a moment.

Mistake Two: The Screenshot Problem.

Attorneys receive screenshots of text message conversations constantly. Clients send them because they’re easy, because they feel like evidence, and because nobody told them otherwise. The problem is that a screenshot is a photograph of information, not the information itself. It shows you what someone wants you to see, cropped to whatever boundaries they chose, dating the evidence to the very time they took the screenshot, with none of the underlying data that makes digital evidence actually useful in court.

Even worse, we regularly get PDFs of screenshots of the evidence, two steps of creation removed from the genesis of the underlying evidence.

A proper extraction of text messages from a phone includes the full conversation thread, the phone numbers associated with each contact, timestamps that can be verified against carrier records, and in many cases deleted messages that the client may not even know still exist. A screenshot gives you none of that. It also gives opposing counsel a straightforward authenticity challenge, because a screenshot can be edited in about thirty seconds by anyone with a basic photo app and an agenda. Courts are increasingly skeptical of screenshots standing alone, and rightly so. If the text messages matter to your case, get the phone examined by someone who can extract the data forensically.

Mistake Three: The Factory Reset.

This is the one that occasionally crosses the line from mistake into something courts take a very dim view of, depending on the timing and the circumstances. People factory reset their phones for all kinds of innocent reasons — selling the device, switching carriers, trying to fix a software problem, general digital housekeeping, following the instructions of a tech support rep. Even just copying the data to a new phone. Hit the wrong button during the process and Poof! All the un-transferred stuff is gone. When it happens after litigation is anticipated and a litigation hold is in effect, innocent reasons tend not to matter as much as you’d hope.

What many people don’t realize is that a factory reset, once it happens, puts you in a very difficult position legally — regardless of what may or may not remain on the device. Which, with newer devices, is usually zilch. Courts don’t look kindly on resets that occur after a litigation hold is in effect, and the explanation of ‘I didn’t know’ tends to land with a thud. The time to have this conversation with your client is before it happens, not after.”

The common thread in all three of these mistakes is timing. Digital evidence is not like paper evidence — it doesn’t just sit in a filing cabinet waiting patiently for someone to come find it. It’s dynamic, it’s fragile in ways that aren’t obvious, and the window for preserving it can close faster than anyone expects. The attorneys who understand this engage a forensic examiner early, preserve the device properly, and go into discovery knowing what the phone contains. The ones who don’t tend to find out what was on it the hard way.

If your client’s phone was examined today, would you know what’s on it — or would you find out the same time opposing counsel does?

Don’t miss a single issue of our informative newsletter … Subscribe!

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

The post The 3 Phone Mistakes That Destroy Digital Evidence Before Trial appeared first on Burgess Forensics.