If you scan the criminal dockets for cases involving cyberstalking, you will notice a persistent pattern. Cyberstalking is rarely the main course. More often than not, it’s just the side dish. It gets tacked onto a primary indictment for domestic violence, extortion, federal wire fraud, witness tampering, or physical assault. On its own, prosecutors routinely treat standalone cyberstalking as too elusive, too resource-intensive, or too easy for defense counsel to poke holes in.

That gives rise to an interesting question for legal practitioners: why is digital harassment so frequently relegated to an “add-on” charge, and what happens when the digital trail is all you have?

Why Standalone Charges Fall Flat

To understand why prosecutors hesitate to bring pure digital stalking cases to trial, you have to look at the practical and evidentiary hurdles that hit the prosecution at intake.

The Attribution Trap: Proving who typed the message beyond a reasonable doubt is still one of the toughest burdens in digital forensics. VPNs, burner phone apps, compromised accounts, and spoofed IP headers leave enough digital shadow to create reasonable doubt if a prosecutor doesn’t have a physical predicate act, like a traffic stop, a seized phone, or a ring camera feed, to anchor the keyboard to a specific set of hands.

Ambiguity of Intent: Digital harassment lives in the grey zone between constitutionally protected speech and criminal threats. Historically, to sustain a charge without infringing on free speech, many statutes required proving a “credible threat” of death or serious bodily harm. To make that point a bit more clearly, “You’re gonna get it!” isn’t likely to be considered a credible threat, whereas “Imma stab you in the eye tomorrow.” would certainly be. Unrelenting, malicious digital harassment that falls just short of an explicit physical threat often left prosecutors without a clear statutory hook.

Plea Bargaining & Resource Constraints: Digital forensics takes time, chain-of-custody documentation, and validated tool outputs that don’t fit neatly into a fast-moving misdemeanor docket. When cases do get charged, standalone digital counts are frequently the first bargaining chips dropped or pled down to simple harassment or disorderly conduct.

Before we go blaming law enforcement for cherry-picking, consider that cyberstalking doesn’t leave the kind of evidence prosecutors are used to (at least, so far). An assault leaves a black eye, bruises, broken bones. A burglary leaves an empty space (possibly the only non-dusty spot) where a stolen item used to be, an embezzler’s work shows up in missing dollars.

The harm – and often the point – is fear, anxiety, and a life rearranged around avoiding someone, none of which photographs very well. The evidence is spread across phones, laptops, social media accounts, email providers, and carrier records, much of it held by third parties who release it only under subpoena or warrant, and some of it gone before anyone thinks to ask. 

The Ground Is Shifting Under the Statutes

While that historical pattern remains true today, the legal and technical landscape is actively evolving. State legislatures and federal prosecutors are adjusting to modern reality, expanding how the law defines course of conduct.

Lowering the “physical threat” bar can result in more prosecutions for different types of harm. Newer statutory models are shifting focus from requiring a fear of physical injury to demonstrating substantial emotional distress or economic harm. This allows prosecutors to pursue standalone charges in severe cases involving doxing, non-consensual image sharing, or orchestrated online mobbing campaigns.

Lawmakers have begun targeting the tools, not just the threats. Legislators are increasingly criminalizing the underlying technology itself. Banning unauthorized GPS/AirTag tracking, stalkerware deployment, and automated mass-messaging tools gives prosecutors discrete, objective physical actions to charge, turning the act of digital surveillance itself into a substantive crime.

Federal Stalking Statutes are being amended and adjusted. The Department of Justice is increasingly utilizing 18 U.S.C. § 2261A to bring standalone federal charges when interstate digital harassment is structured, persistent, and well-documented.

What This Means for Litigators

Whether you handle criminal defense, prosecution, or civil restraining orders (where standalone digital evidence has long been king), the takeaway is simple: the threshold for what constitutes an actionable digital course of conduct is expanding.

In practice, a case rarely hinges on a single smoking-gun text. It hinges on the pattern: login timestamps matching access logs, device sync artifacts, metadata from cross-platform messaging, and correlation between IP hops and known geographic locations.

The laws are changing to meet the reality of modern harassment. The question is whether the digital evidence you are looking at supports a standalone narrative or merely an afterthought.

Have you seen cyberstalking charges brought as a primary count in your jurisdiction, or is it still mostly an add-on to physical claims? I’d like to hear what you’re seeing in the courtroom.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When Cyberstalking Is Just an “Add-On” Charge (And Why That’s Changing) appeared first on Burgess Forensics.

Your next custodian might not have an inbox, a job title, strong feelings about the office thermostat, or about someone nuking last night’s salmon in the microwave.

It might have API access. For the uninitiated, an API is a way for software systems to communicate and request actions from one another.  Think of it as a pal you gave a key to so they could feed the cat while you’re away. They can come in and use the can opener. They are not supposed to go through the medicine cabinet. The logs may help you work out which metaphorical rooms they visited, if anyone enabled the logging.

That should give anyone who drafts litigation holds a moment’s pause.

Two recent pieces in the news caught my attention. Ralph Losey’s August EDRM article, “When AI Agents Go Rogue, the Logs Become Evidence,” looks at the trail an agent leaves as it works across systems: commands, messages, access records, and the technical context around them. K&L Gates’ May 20 Litigation Minute comes at it from the preservation side. GenAI prompts, outputs, uploaded documents, and usage logs may fall within preservation obligations, and they may not be retained by default. Some disappear on a schedule. Others never exist at all unless someone turned on logging before anyone needed it.

Put the two together and you land on an uncomfortable question: does your client’s litigation hold reach the systems that are doing the work?

Isn’t this just the chatbot-history problem again?

Not quite. We’ve previously discussed chatbots as diaries. Somebody types something candid into a chat window, and months later opposing counsel finds it very interesting. A neat way to manufacture an exhibit!

Agents are different because they act. Give one a task and permission, and it may search repositories, pull files, call tools, change records, send messages, or hand the job off to another agent. Depending on the setup, each of those steps can leave records in a different system.

The human’s chat history is one chapter. What the agent wrote is part two.

What does that look like in a real dispute?

Picture a hypothetical procurement agent told to cut spending with a supplier. It reviews the contracts, pulls purchasing data, updates the vendor record, and drafts a termination notice. A manager approves the notice. Six months later, the supplier sues.

You preserve the manager’s email and the final letter. Good start.

Now suppose the case turns on whether the company considered an amendment guaranteeing minimum purchases. Did the agent retrieve it? Did a tool call fail? Was the workflow working from an outdated version? Did the manager see a warning before clicking approve?

The polished letter may tell you very little about how any of that happened. You might think the polish reflects enough light on the subject, but there’s more in deeper, possibly darker, places.

The answers, if they exist, sit in retrieval records, tool responses, approval events, and application logs that nobody put on the collection plan. The manager may remember clicking “approve” and not much else. That isn’t evasion, it may just be delegation.

So is the software a custodian now?

As a working concept, yes, and a useful one. Calling the agent a custodian forces two questions: where is the machine’s work recorded, and who can preserve it? It does not give software legal personhood or put it in a deposition chair. (Although I would pay to watch someone instruct an agent to answer only the question asked.)

Some accountable human should own the workflow, control the settings, and manage the vendor relationship. That person belongs in the preservation conversation, and that conversation needs specifics. Name the tools and workflows that touched the matter. Identify the accounts involved, human and service. Find out what records exist, where they live, and when they expire. Then test that preservation works, because a beautifully drafted hold notice doesn’t necessarily touch automated deletion.

Can’t we just take the agent’s word for what it did?

Um, no, it’s an AI. An agent’s report that it finished a task is a record of what it claimed; it doesn’t prove the task was completed. In our procurement example, “I reviewed all relevant agreements” should send someone looking for the retrieval and access logs that could help verify it. That ever-confident AI statement is not a timestamp.

And by the way, this cuts both ways. The same logs that might reveal a skipped amendment might also show the agent did what it said it did.

Does this mean keeping every machine event forever?

No. Discovery still turns on relevance, proportionality, and privilege. Rule 26 did not acquire an unlimited-storage exception because someone said “agentic.”

Nor does a missing log automatically mean sanctions. In federal court, Rule 37(e) asks, among other things, whether reasonable steps were taken to preserve the information, whether it can be restored or replaced, and whether prejudice or an intent to deprive supports a particular remedy. State rules vary, and how courts will apply all of this to agent logs is still being worked out. That part is your department, not mine. I know, I say this all the time, but it’s true.

So, what to do?

Get curious earlier. At intake, alongside “Who was involved?” ask “What automated systems acted on this?” In custodian interviews, have people walk through the workflow step by step, including the steps they delegated and then never actually saw.

That will tell you more than asking whether they “use AI,” which can mean anything from fixing a comma to letting software negotiate with a supplier.

Your client’s copilots and agents may hold part of the factual record. Find it while it still exists.

Has an automated system turned up in one of your matters yet, either as a source of evidence or as a gap in it? I’d like to hear how it went.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When the AI Is a Custodian appeared first on Burgess Forensics.

We have spent years teaching computers to answer our questions, although sometimes it is the other way around. Now we are teaching them to spend our money. The first time an AI shopping agent orders the wrong shoes, nobody will call a lawyer, but the first time it orders 4,000 of them for a company, somebody will.This isn’t just a mental exercise. In September, Amazon blocked Meta’s Muse agent from shopping on its platform, citing a lack of authorization, an agent that didn’t identify itself, and the handling of customer credentials. Amazon has also blocked some agents from OpenAI and Google. Banks have separately warned that shopping agents may buy the wrong product, exceed a budget, steer customers toward weaker payment protections, or expose them to scams and fraud.

That raises a deceptively simple question: When the bot clicks “Buy,” who agreed to the contract?

The short answer is usually the person or company that deployed, authorized, or controlled the bot—not the bot itself. But the short answer rarely ends the argument. The longer answer, which is the one that could generate billable hours, is whether the bot acted within the authority it was given.

The federal E-SIGN Act provides that a contract involving interstate or foreign commerce cannot be denied legal effect, validity, or enforceability solely because its formation involved one or more electronic agents, so long as the agent’s action is legally attributable to the person to be bound. E-SIGN removes the electronic-agent objection; it does not itself establish agency, assent, scope of authority, or compliance with other applicable law. 15 U.S.C. § 7001(h).  State law may matter as well, including state enactments of the Uniform Electronic Transactions Act (UETA), whose § 14 addresses automated transactions.

So the fact that no human physically clicked the button does not automatically make the transaction disappear. We crossed that bridge years ago with automated ordering systems. Today’s bots are just crossing it with your credit card in their (virtual) hands.

The harder issue is authorization.

Suppose a client tells an agent, “Find me a laptop under $1,500 with at least 32 gigabytes of memory,” and the agent buys one for $1,425. That looks comfortably authorized. Now suppose it buys a $2,300 laptop because it decides the improved processor is “worth the investment.” Helpful initiative, perhaps. Also a decent opening paragraph for a complaint.

Agency principles will matter. What authority did the user actually grant? What limits appeared in the prompt, account settings, purchasing policy, or platform terms? Did the user authorize the transaction itself? Did the merchant’s terms allow this type of automated or third-party access? Did the agent have authority to manifest assent to the merchant’s terms on the user’s behalf? And did the merchant have reason to know that the agent was operating outside its instructions?

These disputes will be won or lost on the digital record, and much of that record is logs.

Attorneys should stop thinking of the receipt as the complete record. It’s not a piece of paper in your pocket. The relevant evidence may include the user’s original prompt and follow-up instructions; spending limits and product filters; whatever agent action history exists, tool-call logs, audit trails, and system events; model and software versions; authentication records; cart changes; confirmation screens; and the merchant’s server logs.

Collect it early. AI systems and their vendors do not necessarily retain every step indefinitely. A clean-looking final confirmation can conceal ten earlier decisions, three rejected products, a changed budget, and one hallucinated free-shipping offer. Hallucinated by the bot, that is.

Then there is the chargeback problem. Consumers may assume that “the AI did it” means “unauthorized.” Card issuers and banks may see a more complicated record. A purchase made through credentials deliberately supplied to an agent is not automatically equivalent to a stolen-card transaction. Whether a customer has a chargeback right, an error-resolution claim, or some other remedy may depend on the payment method, the issuer’s and network’s rules, the authentication record, the instructions given to the agent, the merchant’s conduct, and whether the agent made an unauthorized purchase or merely made an authorized purchase badly.

In other words, buyer’s remorse does not become a stolen-card case just because software was involved.

Fraud and privacy add another layer. A shopping agent may see card details, purchase history, addresses, brand preferences, and perhaps the contents of an email account or calendar. A compromised agent could make an unauthorized purchase. A perfectly functioning agent could also be manipulated by a fraudulent listing, a poisoned recommendation, or a merchant designed to look legitimate to software rather than to a human.

For attorneys advising businesses, now is the time to ask practical questions. Are agent-made purchases permitted? Is human approval required above a stated amount? Are transaction logs preserved? Can the system explain which instruction caused it to choose a product? Can the agent accept arbitration clauses, subscriptions, or recurring charges? And who receives the alert when it gets creative?

Like agency law, consumer protection, and the rules of evidence, contract law isn’t going anywhere. It just has a new participant: one that works quickly, reads terms instantly, and has never once felt the healthy hesitation that comes from entering a credit-card number. Has it ever felt anything?

The bot may have clicked “Buy.” The case may turn on who told it that it could.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post Your Client’s Shopping Bot Clicked “Buy.” Who (or What) Made the Contract? appeared first on Burgess Forensics.

TV has made digital forensics seem like it’s a piece of cake—all you have to do is lean toward a blurry security camera frame, say “Enhance,” and it will work. Every time. (At least on CSI.)

In honor of the week, here are a few things television has taught the public about digital forensics, along with what actually happens in the real world.

“Enhance.”
On TV, three keystrokes turn 40 pixels of smudge into a readable license plate. And then the computer instantly gives up the name, age, address, and next of kin for who it’s licensed to. In real life, you can’t recover detail the camera never captured. Enhance a smudge and you get a bigger smudge. (A very well-documented bigger smudge, but still.)The 30-second hack.
Hoodie, dark room, green text scrolling, “I’m in. The perp is on Hollywood & Vine and has a small thermonuclear warhead in his backpack. Get on it, STAT!” In real life, a forensic image of a phone can take hours, it has to be in the examiner’s hands, and reviewing what comes out of it can take days. The green text is optional.Deleted means gone.
The TV villain deletes a file and pours a drink. Not on the keyboard. Deleting a file is more like taking the name off a mailbox. The house is still standing until somebody new moves in, and there may be copies in the cloud, on a backup, or on the phone of the person who received it.

Results before the commercial break.
Real forensic work runs on chain of custody, hash values, validated tools, and documentation that would put a prime-time audience to sleep. That’s the point. It’s what holds up when the other side’s expert goes through it line by line. The documentation, not the TV script.

The expert always works for the good guys.
On TV, the real expert works for the good guys and the bad guy’s expert is always overconfident In real life, the evidence doesn’t know who hired you, and the examiner shouldn’t care. The data is the data, and it shows what it shows.My favorite TV forensic tech.
Numb3rs, Season 2, Episode 8, “In Plain Sight.” Amita Ramanujan opens the top casing plate of the hard drive (exposing the magnetic platters to open air – this is such a no-no!) and proceeds to wave a handheld magnetic sensor wand over the open spinning disks while Charlie watches the data flow onto the display screen. Oh, how I wish!Forensic science is slower and less photogenic than television. It’s also more interesting, because it’s real. Really.

#ForensicScienceWeek #DigitalForensics #eDiscovery #ExpertWitness

The post Happy Forensic Science Week! appeared first on Burgess Forensics.

Your client wanted an early start. What he handed over was an early Exhibit A.

Picture this: he knows he’s under investigation, but he’s anxious, he can’t sleep, and he wants to get ahead of the thing. So, he opens a chatbot at 1 AM and does what people do now: he talks, he types, he lays out his whole preferred theory of defense. He talks to his AI adviser about arguments that worry him and the facts he’d rather nobody saw. Thirty-one documents worth of them, as it turns out.

And then the FBI executes a search warrant, and those thirty-one documents come off his devices. Oh, no.

He says they’re privileged. The court says they’re not. Oh, double no.

That’s the short version of United States v. Heppner, decided in the Southern District of New York in February 2026. Judge Jed Rakoff held that a securities-fraud defendant’s conversations with a public AI tool (Anthropic’s Claude, as it happens) were protected by neither attorney-client privilege nor the work-product doctrine, and were fair game for the government to keep and cherish. Even if it was privileged when Heppner told it to attorneys, he waived the privilege when he disclosed it to Claude.

I’m a computer geek, not a lawyer, so I’ll stay out of the deep end on privilege doctrine. That’s your department, counselor. But the data side of this is my lane, and there’s a moral to the story.

“Come on. It’s just a fancy word processor.”

That was the argument, more or less, and the court didn’t buy it. See, a word processor doesn’t answer back. When your client types into a public chatbot, he isn’t just taking notes; he’s having a conversation with a third party. And sharing it with a third party can waive the confidentiality on which privilege depends.

It’s easy to forget that it’s not only that a human somewhere might read it. If you read the privacy policy on many consumer AI tools you’ll likely find that the provider reserves the right to log what you type, use it to train the model, and to hand it over to regulators or law enforcement when asked. And don’t even start with what happens to the data if and when another company buys the AI company.

He thought he was talking to a machine that forgets. Nope. Depending on the service, he was talking to one that remembers, transcribes, and keeps all the receipts.

“But he showed it to his lawyer afterward. Doesn’t that make it privileged?”

Privilege isn’t a stamp you get to press onto a document after the fact. The court was clear that sharing a preexisting document with counsel later doesn’t reach back in time and wrap it in protection. The horse is already out of the barn and Elvis has left the room. Walking it past your attorney on the way out doesn’t reverse history and put them back.

Rakoff found work product didn’t save it either. Under the Second Circuit authority he applied, the documents weren’t prepared by or at the behest of counsel and didn’t reflect counsel’s strategy, but rather that he made these on his own initiative, before anyone told him to. No lawyer’s fingerprints on it and no protection.

“So AI is radioactive now. Great.”

Well, not quite. Judge third left a door open. He suggested that if counsel had directed the client to use the tool, the AI might function more like a lawyer’s agent, the way a translator, an e-discovery vendor, or a forensic examiner does when brought in under the attorney’s umbrella. Different setup, potentially different result.

So the line that matters isn’t “AI, yes or no.” It’s who’s driving, under what terms, with what confidentiality. A consumer chatbot your client opened alone, long before dawn, is one thing. An enterprise tool, deployed under counsel’s direction, with a contract that forbids training on your data and locks down disclosure, is a very different animal. Same technology. Different lock, different key.

What does a forensics guy care about any of this?

Well, because I’m the one who finds it.

When a device comes in for examination, at least a portion of chatbot histories could be just another artifact now, sitting right alongside texts, browser history, and deleted photos. They’re potentially recoverable, they’re timestamped, and they read like a diary. People unwittingly treat these tools as a confidant that won’t repeat what it heard. Whether the exam is for the defense or the prosecution, the evidence is the evidence. If it’s there, it’s there.

That cuts both ways, by the way. It isn’t only defendants who overshare with a chatbot. Witnesses do it. Executives do it. The person on the other side of your case may have a transcript on a laptop that’s every bit as revealing, and under Heppner, likely to be discoverable.

Human nature doesn’t change but tools do. People have always talked too much when they’re frightened or overconfident. What’s new is that the confidant now writes it all down and reserves the right to share it.

So, what to do?

A few practical points from the data side of the fence. The privilege calls stay with you.

Ask early. When you map a client’s devices and accounts, ask which AI tools they’ve used and what they typed into them. It belongs on the same checklist as their email, their texts, and their cloud backups.

Limit the AI. ChatGPT and Gemini have Temporary Chat, Claude and Perplexity have Incognito Chat. As of September, 2026 some of the limitations include:

• ChatGPT Temporary Chat: not in ordinary history or memory and not used for training; OpenAI says a copy may remain for up to 30 days.
• Claude Incognito: not saved to chat history or memory and not used for training, but Anthropic normally retains it for 30 days.
• Gemini Temporary Chat: not in recent chats/activity and not used for training or personalization, but Google retains it for up to 72 hours.
• Perplexity Incognito: memory and search history are disabled; current Perplexity documentation says incognito sessions can persist for 24 hours.

These limit what is saved to tool memory, reflection, model training bit are not any guarantee that there won’t be artifacts saved to the local device.

Assume it’s recoverable. “I deleted the chat” is not the same as “the chat is gone.” Treat a chatbot transcript like any other piece of ESI, because, by and large, that’s what it is.

Get people off the consumer tools. The cheapest fix is behavioral. A client who understands that typing his case into a public chatbot is like telling it to a stranger on a train tends not to do it in the first place.

Bring the tool inside the tent. If AI is going to be part of the work, the setup, including direction, terms, and confidentiality, is what may keep it protected. Structure it on purpose, not by accident.

I’ll leave the doctrine to the lawyers. But I’ll say this much. Heppner isn’t really a story about artificial intelligence. It’s the oldest story there is with a new gadget in it. Typing to a chatbot may be no more secure than telling your neighbor, “Don’t tell anyone, but…” Confidentiality has always been something you can give away without meaning to. The chatbot just made it easier than ever.

Have you started asking clients about their AI use when you map their devices? I’d be curious what you’re finding, and whether you’ve seen one of these transcripts turn up where nobody expected it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

The post Your Client Told a Chatbot His Defense Strategy. Is It Still Privileged? appeared first on Burgess Forensics.

Your phone has been keeping a travel diary. For years, Google kept a copy too.

That made possible one of the more controversial investigative tools of the smartphone era: the geofence warrant, sometimes called a reverse-location warrant. Instead of starting with a suspect and asking where that person’s phone had been, police could start with a place and a time and ask Google which devices had been there.

It was the sort of technology made for a crime show and sure enough, it’s likely been in countless episodes of this and that cop show, with thousands of mentions in the news headlines. Draw a circle around the crime scene, pick a time window, find the phones inside it and start looking for your suspect.

There was just one problem. By the time the Supreme Court finally ruled on the practice this summer, Google had already pulled the plug on the system that made the classic Google geofence warrant work.

First, what exactly is geofencing?

The terminology gets muddled, especially outside the technical world.

Geofencing is a technology; a geofence warrant is a legal process that uses location records in a very particular way.

Geofencing itself is not dead, illegal or particularly exotic. A geofence is simply a virtual geographic boundary. Apps can use one to do something when a device enters or leaves an area. Retailers can use it to serve ads, which is just what we need – more ads, no? Your shopping app can notice that you’re near a store. A fleet-management system can report when a truck reaches a destination. Your smart-home system might turn on the lights for you when you get home.

A geofence warrant turns the idea around.

Instead of asking whether one known device crossed a boundary, investigators historically could give Google a geographic area and a time period and compel it to search its Location History database for devices whose records put them inside the “fence.” Initially, Google returned anonymized device information. Investigators could then narrow the candidates and, through additional steps, obtain identifying information. For some time, the technique was anything but obscure: Google received 982 geofence warrants in 2018 and more than 11,000 in 2020.

An ordinary warrant says, in effect, “Tell me where this person was.”

A geofence warrant says, “Tell me who was here.”

That difference became a rather large constitutional question.

Then Google changed the map.

In December 2023, Google announced a major redesign of Location History, now presented to users as Google Maps Timeline. Instead of keeping Timeline centrally on Google’s servers, Google said the information would be stored on the user’s device.

Google’s public explanation emphasized privacy and customer control. The company said putting Timeline on the device would give users “even more control” over this personal information. Location History was already opt-in and off by default.

There was another consequence, and it was a big one.

Once Google no longer possessed a giant centralized repository of users’ Location History, police could no longer hand Google a circle and a time period and have it search that repository for everybody inside.

Reporting at the time suggested that was not an accidental side effect. Forbes reported that a Google employee said that, along with the privacy benefits, the change was intended specifically to bring an end to these broad location searches. Google’s public announcement itself did not say that, so I wouldn’t put words in Google’s mouth. But the practical result is beyond dispute.

The migration took time. By July 2025, according to Google and the Supreme Court, Location History was being stored on individual devices rather than Google’s servers. Google told the Court that it was therefore no longer capable of responding to geofence warrants seeking that Location History data.

In other words, Google leapfrogged SCOTUS and redesigned where location evidence was stored.

Then SCOTUS arrived. On June 29, 2026, the Supreme Court decided Chatrie v. United States.

The case arose from a 2019 Virginia credit union robbery. Investigators did not initially know who the robber was. They obtained a geofence warrant directing Google to search Location History information for devices in the area with a 150-meter radius around the building during the relevant period. That process eventually helped identify Okello Chatrie.

The Supreme Court held that police conducted a Fourth Amendment search when they acquired Chatrie’s location information from Google, because a person has a reasonable expectation of privacy in his cellphone location information.

That’s significant., but it is narrower than saying, “The Supreme Court outlawed geofence warrants.” It didn’t.

The Court did not decide that every conceivable geofence warrant is unconstitutional, nor did it finally resolve whether the particular warrant in Chatrie satisfied all the requirements of the Fourth Amendment. Those questions remain more complicated.

And there is a touch of technological irony here. Justice Alito’s dissent actually called the Google procedure before the Court “now-obsolete.”

Rarely does technology have the courtesy to become obsolete while the Supreme Court is still writing the opinion.

So, are geofence warrants dead?

Google’s classic Location History geofence warrant largely is, but geofencing itself isn’t. Reverse-location searching isn’t necessarily, either.

Incidentally, Apple isn’t an alternative source for the same information. Apple says it has no data to provide in response to geofence requests. At least as far back as 2015, Apple was telling law enforcement that it did not track the geolocation of individual devices or retain GPS information for a specific device or user. An iPhone may know a great deal about where it has been. That doesn’t necessarily mean Apple does.

Other companies, however, may hold different kinds of location data that law enforcement can seek. Telecommunications carriers, app providers, ride-sharing companies and other services can possess records tied to where a device or account was at a particular time. Those systems are technically different from Google’s old Location History database, and they should not all be lumped together simply because somebody draws a circle on a map.

More important for lawyers, location evidence itself certainly hasn’t gone away.

Phones still contain or generate GPS information, Wi-Fi and Bluetooth data, application location records, photographs with location metadata, navigation history and other traces that may help answer the familiar question: Where was this phone?

But the source matters. So does the acquisition method.

A targeted search warrant for a known person’s records is not a Google geofence warrant. Location evidence extracted from a seized phone isn’t one either. Cell-site records aren’t Google Location History. A map with a dot on it may look wonderfully definitive on television, but the underlying technology determines what that dot actually means.

That is where the forensic work begins.

The map still isn’t the territory

Whatever Chatrie ultimately does to Fourth Amendment law, the forensic caution remains the same.

Location data can be remarkably powerful, and it can also be remarkably easy to oversell. A coordinate may carry an accuracy estimate. Different technologies derive location differently. A phone in a building is not necessarily a person in a particular room, and a dot on a map did not acquire certainty merely because PowerPoint made it red.

Ask where the location came from. Ask how it was collected. Get the underlying records and available accuracy information rather than relying solely on the tidy map someone prepared from them.

The old Google geofence may have gone away before the Supreme Court could finish arguing about it. The larger question has not:

When a phone tells us where it was, exactly what does it know, who else can get that information, and how certain should we be? Or, as The Bard might have imagined: To be there or not to be there: that is the geofence question. The forensic question is how well the data can answer it.

When has location data in one of your cases turned out to say less, or more, than everyone first assumed?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Geofence Warrants After Chatrie: SCOTUS Ruled on a Search Google Already Killed appeared first on Burgess Forensics.

By Steve Burgess, Burgess Forensics, 2026

“He passed last month, and his whole life is locked inside his phone. Can’t you just get in?”

I hear some version of that rather often —more than you might think, in fact. The request comes from grieving families, from fighting families, and from the attorneys handling their estates.

From the grieving, it’s asked with a kind of hope. It’s as though the phone were a filing cabinet, and I kept the master key in a drawer. From the fighting, it’s asked with a harder edge, and even a kind of unfounded certainty, because by then everyone suspects the phone is holding something someone would rather it didn’t.

Sometimes I can help. Often the honest answer is: it depends on who planned, what’s stored where, and a couple of laws most people have never heard of.

A person’s digital life doesn’t end when they do. It just sits there —email, photos, messages, cloud backups, a crypto wallet, the online business, the loyalty points, the birthday wishes from casual friends who didn’t realize the intended recipient is gone —waiting for someone with the right authority (and sometimes the right password) to come along. The question your client is really asking is who that someone is, and whether the door will open when they get there.

“Isn’t the executor just entitled to all of it?”

Not automatically. This surprises people. Two things do most of the governing here, and they don’t always pull in the same direction.

The first is a federal privacy law, the Stored Communications Act, written in 1986, before almost any of your clients had an email address. In plain terms and except in narrow circumstances, it bars the companies that hold the actual words of emails, messages, and the rest of the electronic communications from handing over the contents. It really doesn’t care that Grandma died and the family is grieving. A provider can face liability for oversharing, so its reflex is “no.”

The second is a state law that most states have now adopted: RUFADAA —the Revised Uniform Fiduciary Access to Digital Assets Act (yes, it’s a mouthful; blame the committee that named it). Drafted by the Uniform Law Commission, it has been adopted in most U.S. states, though details and terminology may vary by jurisdiction. It gives executors, trustees, and agents under a power of attorney a legal path to a decedent’s digital assets while carving out those private communications for extra protection, to stay on the right side of that 1986 federal law.

Now the necessary disclaimer, and I mean it: I’m a forensic examiner, not a lawyer. RUFADAA’s details vary from state to state, so treat what follows as the lay of the land, not legal advice for your jurisdiction —that’s your department (or your attorney’s), not mine. But the structure is worth knowing cold, because it may decide who wins before a referee enters the picture.

The three-rung ladder (and it’s upside down from what people expect)

RUFADAA sets a priority order for who controls an account. Picture a ladder that the platform reads from the top down.

1. The online tool. If the person used a tool the platform itself provides, such as Facebook’s Legacy Contact, Google’s Inactive Account Manager, Apple’s Digital Legacy, then that choice sits on the top rung. It can even override a contradictory will. Let that land: a two-minute setting on a phone can outrank a document a lawyer carefully drafted.
2. The estate documents. No online tool? Then the directions in the will, trust, or power of attorney control who gets what, which is exactly why explicit “digital assets” language belongs in those documents now, not someday.
3. The fine print. Nothing from above? Then the platform’s terms of service decide. But note that those were written to protect the platform, not your client’s heirs.

Most people are sitting on rung three without knowing it.

So, what do the big platforms actually do?

• Apple’s Digital Legacy can provide a designated Legacy Contact access to eligible Apple Account data, such as certain iCloud-stored photos, files, notes, messages, and device backups, after Apple approves a request supported by the access key and proof of death. It does not provide the decedent’s device passcode or decrypt a passcode-locked device, although Apple can remove Activation Lock. It’s one of the more generous setups, though. One caveat: if a paid iCloud+ account stops being paid, Apple does not guarantee indefinite preservation of data exceeding the free storage allowance and reserves the right to restrict access to or delete stored content.
• Google’s Inactive Account Manager is triggered by inactivity, not death. Set a window, say, three or eighteen months, and Google will either share the data you chose with the people you named, or delete the account. If nobody set it up, the family is left negotiating with support. Inactive Account Manager is an access plan, not a preservation plan: Google’s separate inactivity and storage-quota deletion policies still apply.
• Facebook memorializes an account once it learns of a death, and a Legacy Contact can tend that memorial page, but Facebook does not hand over private messages. Full stop.

The pattern: the cloud is a locked building, and every landlord has its own rules for who gets a key, and which rooms that key opens.

Note that companies change policies and the above are accurate as of the writing of this article.

“What if I need it for a case, not the estate?”

This is where the fighting families come in. Same walls, different reason for wanting in. When a decedent’s texts or emails matter to a wrongful-death claim, a probate contest, or a business dispute, a subpoena to the provider still runs headfirst into the Stored Communications Act on content. Still, a properly authorized fiduciary may have a stronger route to a catalogue of communications or other non-content records than to message content, though providers may require formal documentation and may impose statutory or policy-based conditions.

Which is why, in my line of work, the device usually beats the cloud. A phone, laptop, or backup that’s lawfully in the estate’s possession, when examined with proper authority, frequently holds the messages, photos, and app data the platform won’t volunteer, plus deleted material that never made it into any legacy tool.

The catch is always the same pair: authority and access. The right to look, and a way in. And that “way in” is the quiet crisis. Desktop and laptop computers, and their physical backup drives, often give the enterprising computer geek a number of ways in. We’re frequently called on to excavate these potentially rich sources: existing files, deleted ones, and former drafts of the very documents and evidence a case turns on.

Phones are another matter. Modern ones are encrypted by default, so without the passcode, a legacy contact, or a good backup, even the family’s own forensic examiner can end up staring at a very expensive brick. (“Encrypted” isn’t always the dead-end people assume —but it isn’t a guarantee either.)

So, what to do?

This is the easy part, and it’s worth handing to clients now rather than litigating later.

• Set the online tools. Apple Digital Legacy, Google Inactive Account Manager, Facebook Legacy Contact. It only takes about five minutes each, and they sit on the top rung of the ladder.
• Put digital assets in the estate plan. Explicit language in the will, trust, and power of attorney authorizing the fiduciary to access digital assets, including the content of communications, is exactly the consent RUFADAA and the SCA are looking for.
• Keep an inventory, not a password list in the will. A will can become a public record; a sealed, separately stored list of accounts and where the keys live does not. Crypto especially. Custodial exchanges may have separate estate-access procedures, subject to identity, probate, and compliance requirements. But self-custodied crypto is unforgiving: no seed phrase or proper login and no crypto coins for you. No exceptions.
• Don’t “clean up” the device. For anything that might become contested, powering through a phone or running a factory reset can destroy evidence. It’s also very likely to raise spoliation questions in a contested case. When in doubt, preserve first and examine later.

The uncomfortable part

Most of us have built a whole second life online without realizing and left no instructions for it. For your clients, a few minutes of planning turns what would have been a legal-and-forensic headache into a routine handoff.

What’s the messiest digital-estate tangle you’ve run into? A locked phone nobody had the code to, a memorialized account, a crypto wallet with no key in sight? I’d like to hear how it played out.

Burgess Forensics: (866) 345-3345  |  steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post What Happens to Your Digital Life When You Die (And Who Can Access It) appeared first on Burgess Forensics.

The format language in a discovery request is easy to skip over. It looks like boilerplate. It reads like boilerplate. It is actually boilerplate. And so it gets waved through: “produce as PDF, that’s fine.” Maybe not so fine when that same attorney later pays me to explain why the file on my screen can’t answer the question the case now turns on.

Here’s the thing the other side already knows: whoever picks the format picks what you get to see. It’s just how the rules work. Under Federal Rule of Civil Procedure 34(b)(2)(E), the party asking for the documents gets to specify the form they arrive in. Don’t specify, and the choice falls to the producing side, with “reasonably usable” form as the only floor — and reasonably usable is a long way from native. Say nothing about format and you’ve handed them the pen.

Native files vs. PDFs sounds like an argument for the IT department, right? It isn’t. It’s one of the quietest, most consequential fights in the whole discovery process, and it’s worth having on purpose.

A PDF is a photograph of a document, not the document

A native file is the thing itself – the spreadsheet with its formulas still doing math, the email with its full routing header, the Word file that still remembers every draft, the photo that quietly wrote down where and when it was taken. I have a paragraph in my engagement letter saying so, albeit a bit more succinctly. A PDF or a TIFF is a picture of that file after someone chose the pose.

What really gets me is when evidence is produced as a printout of a PDF of a scan of a PDF created from the actual original file. Happens all the time. But it’s several steps away from what really happened and far from the metadata that tells the real story.

Such “pictures” drop exactly the parts that tend to win cases. Most of the metadata, describing fields such as who made it, when, on what device, and sometimes where tends to get lost when a PDF is generated from it. This is the difference between “he says he wrote it in March” and knowing, to the minute, that he didn’t.

A spreadsheet may show you a very precise value of 4,203,722.46 in the flattened PDF version but hides the formulae and structure that generated a possibly different number. A document that previously contained all the things people put in a document before they remembered other people would read the tracked changes, comments, hidden rows? Native format keeps them. The flattened copy forgets them, conveniently.

Hash values and container data are integrity signals that may let you and me confirm that the document produced is the same as the original are casualties of a PDF export. It snaps that verification thread and asks you to just take everybody’s word for it instead.

None of it comes back, either. You can’t un-flatten a PDF into the original any more than you can un-fry a flapjack. Once it’s produced that way, the missing data isn’t hiding from you. It’s gone.

I had a case where the “date digitized” EXIF metadata from a series of photos supported one side’s story. However, deeper in the metadata, there was satellite data that cast real doubt on the story being told. Satellites and their atomic clocks don’t lie about the time or the day.

Why the other side is so agreeable about it

Producing in PDF usually isn’t laziness. It’s control wearing the costume of laziness. A flattened production is easier to redact, easier to Bates-stamp, and, in a happy coincidence, easier to sanitize. The timestamp that wrecks the timeline, the author who wasn’t supposed to be within a mile of that memo, the formula that shows how a number really got built: all of it vanishes in the conversion, and it vanishes wearing the respectable coat of “routine document handling” rather than the orange jumpsuit of spoliation.

To be fair, imaged production isn’t always a dodge. Sometimes there are honest reasons for it — privilege review, redacting personal or protected information, or real proportionality under Rule 26(b)(1) when native would cost more than the whole dispute is worth. Those reasons are legitimate. The trick is to make the other side say so out loud, in the protocol, so that “we imaged it” has to be justified rather than simply assumed.

I should be clear that “save as PDF” is also a genuinely lousy way to strip metadata even when someone’s trying to be honest. It leaves things behind and takes things it shouldn’t. But that’s a different article. For today: the party that controls the format controls the evidence, and they know it even if your side doesn’t.

The fight is won in the ESI protocol, not in a motion six months later.

This is the part I most want attorneys to hear. By the time you’re standing in front of a judge complaining about a bad production, you’re asking to redo work the other side has every incentive to slow-walk into the next fiscal year — and you’re explaining to your client why the schedule, and the bill, went sideways. Nobody enjoys that conversation. Least of all the person who once said “PDF is fine.”

So specify the format on the front end, in writing:

• Ask for native formats, with metadata, by default for anything data-rich — spreadsheets, databases, structured exports — with load files that actually carry the field data. Boring to negotiate. Priceless to have.
• Name the metadata fields you want. Custodian, author, created and modified dates, an MD5 or SHA-1 hash, and parent/child relationships so attachments stay tied to their emails. “With metadata” is an invitation for the other side to read the phrase as generously as their conscience allows.
• Reserve the right to request native format for anything produced as an image, and say so up front — so when you invoke it, it’s a term of the deal and not an ambush they get to act wounded about.
• Bring your examiner in before the language is set, not after the production disappoints. Format specs written without technical input have a real talent for asking, very precisely, for the wrong thing.

The bottom line

This is not enhance-the-reflection-in-the-sunglasses forensics. It’s plumbing. It’s unglamorous, it’s easy to skip, and it is very often the only thing standing between evidence you can build a case on and a tidy picture of evidence you have to take on faith.

Courts increasingly expect native production where format carries meaning, and (hopefully) increasingly treat “well, we already gave you a PDF” as the weak answer it is. But you don’t drift there by luck. You get there by treating format as a substantive term of the case — argued with the same seriousness as scope and custodians, and about a thousand times more attention than it usually gets.

Have the fight early. It’s a great deal cheaper than the one you’ll have later, in front of a judge, with your client and their checkbook watching.

What’s the worst production-format surprise you’ve run into — native you wish you’d demanded, a PDF that turned out to be hiding the whole case, or something else entirely?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Native Files vs. PDFs: Why Discovery Format Fights Are Worth Having appeared first on Burgess Forensics.

When a client or opposing party says “he deleted everything,” attorneys often hear a dead end. I hear the opposite and you probably should as well. In digital forensics, deletion is rarely the end of the story. In fact, it may be the beginning of a better one.

What most people don’t understand is that hitting delete doesn’t erase data. It tells the system that the space can be reused. Think of it less like shredding a document and more like taking the label off a file folder and telling the office it’s okay to reuse the drawer — the pages are still in there until someone actually needs the room and drops the pages in a shredder. Until something overwrites it, the underlying data often sits right where it always was. On phones, computers, and servers, deleted files, messages, and app data are frequently recoverable in whole or in part. While deleted phone data is somewhat more ephemeral and tends to become unrecoverable after a couple of months, other platforms are less so. In many cases, we have recovered them months or even years later.

Still, recoverability is only half of it. The more valuable half is what the act of deletion reveals.

Deletion leaves its own trail. Modern devices tend to be relentless record-keepers. They document nearly everything, often including their own attempted cover-ups. When someone deletes files, wipes an app, clears a chat, or runs “cleaner” or “wiping” software, those actions frequently generate their own artifacts: timestamps, log entries, system events, and traces in backups and cloud sync. In practice, you may be able to prove not just what existed, but when it was removed, and sometimes that a wiping tool was run at 2 a.m. the night before a device was handed over. We had a case where the inspection got stalled for a couple of days to give time for the IT guy to scrub away. However, the file-destroying tool kept a record of every single file it destroyed over the previous very busy nights.

Nothing says “nothing to hide” quite like a freshly installed disk-scrubbing utility. That timeline can be more persuasive to a fact-finder than the deleted content ever would have been.

Intent is the story. A single deleted photo is a fact. A coordinated wipe — messages cleared, a drive reformatted, cloud backups switched off, all clustered around a key date — is a narrative unto itself. Courts have well-developed doctrine here. Spoliation of evidence can support sanctions and, in many jurisdictions, the dreaded adverse-inference instruction: the jury may be told they can assume the destroyed evidence would have hurt the party who destroyed it. The person trying to make the problem disappear might just be manufacturing a bigger one, wrapped up with a bow on top.

The copies that survive. Data rarely lives in one place. A message deleted on a phone may survive in a backup, on the other party’s device, in a cloud account, or on a synced laptop nobody remembered was still logged in. Deleting the local copy does nothing to the dozen copies elsewhere. The modern device can be quite the bothersome gossip –  it tells your secrets to every other device it meets. Part of a competent forensic examination is simply knowing where those copies tend to hide.

Besides the potentially recoverable file being looked for, many programs, especially Microsoft Office, make invisible copies every time a file is open. Invisible to the user, that is – not to the examiner.

So, when the other side deletes everything, they may accomplish three things that help you: they leave recoverable data behind, they create adocumented record of the destruction, and they hand you a consciousness-of-guilt argument you didn’t have before. That’s a rough return on investment for a night or two filled with buckets of coffee and frantic clicking.

A few practical notes for counsel. Move fast. Recoverability drops as devices keep running and space gets overwritten, so preservation letters and litigation holds matter enormously.

Preserve the device itself, not just exports; a proper forensic image captures far more than a manual copy. And loop in an examiner early, before well-meaning IT staff or clients “poke around just to check” and overwrite the very evidence you’re trying to save. Curiosity has damaged more cases than it has solved.

“He deleted everything” isn’t the moment your case falls apart. More often, it’s the moment it gets interesting.

A question for the litigators: what’s a situation you’ve had where deleted data actually strengthened your side of the case? I’d be curious to hear how it played out. The best forensic stories usually start with someone who was very sure they’d covered their tracks.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Why “He Deleted Everything” Is Usually Good News for Your Case appeared first on Burgess Forensics.

A fitness tracker once told me the exact moment its wearer stopped moving. Not slowed down. Stopped. The device wasn’t built to establish a time of death. It was builtto count steps and nag its owner about standing up more often. But it kept a continuous record, and that record answered a question nobody had thought to ask it.

I can’t reveal much about the case. The survivors believed the facility had let conditions get too hot for too long with too little warning. The other side believed close to the opposite: that the tracker’s own history showed the deceased knew better than to push that hard through a changing but controlled environment. Both sides were arguing about the same person’s habits, and the tracker had a record of them. Dueling cardiologists reached differing conclusions about the fitness level of the deceased.

I did not expect a line chart to affect me. Heart rate climbing to a dangerous peak, dropping to zero, then flat and never moving again. Plain as any spreadsheet. Then I imagined what that jagged line meant on the floor of the event.

That case is the whole of digital forensics in one artifact. People imagine this work is about clever adversaries planting evidence. I hear that concern regularly, and it is rarely what actually happened. The real story is duller and much harder to argue with: an ordinary device did exactly what it was built to do, and nobody remembered that what it was built to do includes keeping a record.

Your house is full of these. A video doorbell logs every motion event with a timestamp, whether or not itsaved any video.A voice assistant logs when it woke up, and sometimes what it heard in the few seconds on either side, depending on a setting its owner has never opened or knew existed. A thermostat infers occupancy from temperature adjustments and motion, which turns out to be a decent proxy for whether anyone was home. A robot vacuum holds a floor plan of every room it has ever cleaned. A car knows where it went and how fast it got there. It is getting harder and harder to have a good ol’ dumb home.

None of this was designed to be evidence, which is one reason it can become powerful evidence when properly authenticated and interpreted. There may still be questions about reliability, chain of custody, retention settings, incomplete logs, and similar issues, but the device itself has no made-up story to keep straight. It is not shaped by human memory in the way witness recollection is, though it still has to be interpreted carefully. Someone can be careful about what they say out loud and still be wearing a watch that logged a heart rate spike at the moment in question.

The law is still catching up. Carpenter v. United States narrowed the old assumption that anything you hand to a company is fair game without a warrant, at least for cell site location records. Aside from preservation duties, discovery scope, and the need to meet and confer, there is a live question whether that reasoning will narrow access to data from a thermostat, a vacuum’s floor map, or a year of refrigerator door-open events. Those boundaries are being worked out one motion and one court at a time as we speak. I would not bet on the answers looking the same in five years as they do today.

For lawyers, the lesson is simple: ask early what connected devices were present, where the data is stored, how long it is retained, and who controls it.

In the meantime, the practical reality is simpler. Your home has more employees than you think, and all of them are taking notes. None of it is malicious. Much of it may be discoverable or obtainable, if someone thinks to ask.

What smart-device data point has surprised you most, in a case or in your own house? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Your Smart Home Is Testifying Against You appeared first on Burgess Forensics.