Your phone has been keeping a travel diary. For years, Google kept a copy too.

That made possible one of the more controversial investigative tools of the smartphone era: the geofence warrant, sometimes called a reverse-location warrant. Instead of starting with a suspect and asking where that person’s phone had been, police could start with a place and a time and ask Google which devices had been there.

It was the sort of technology made for a crime show and sure enough, it’s likely been in countless episodes of this and that cop show, with thousands of mentions in the news headlines. Draw a circle around the crime scene, pick a time window, find the phones inside it and start looking for your suspect.

There was just one problem. By the time the Supreme Court finally ruled on the practice this summer, Google had already pulled the plug on the system that made the classic Google geofence warrant work.

First, what exactly is geofencing?

The terminology gets muddled, especially outside the technical world.

Geofencing is a technology; a geofence warrant is a legal process that uses location records in a very particular way.

Geofencing itself is not dead, illegal or particularly exotic. A geofence is simply a virtual geographic boundary. Apps can use one to do something when a device enters or leaves an area. Retailers can use it to serve ads, which is just what we need – more ads, no? Your shopping app can notice that you’re near a store. A fleet-management system can report when a truck reaches a destination. Your smart-home system might turn on the lights for you when you get home.

A geofence warrant turns the idea around.

Instead of asking whether one known device crossed a boundary, investigators historically could give Google a geographic area and a time period and compel it to search its Location History database for devices whose records put them inside the “fence.” Initially, Google returned anonymized device information. Investigators could then narrow the candidates and, through additional steps, obtain identifying information. For some time, the technique was anything but obscure: Google received 982 geofence warrants in 2018 and more than 11,000 in 2020.

An ordinary warrant says, in effect, “Tell me where this person was.”

A geofence warrant says, “Tell me who was here.”

That difference became a rather large constitutional question.

Then Google changed the map.

In December 2023, Google announced a major redesign of Location History, now presented to users as Google Maps Timeline. Instead of keeping Timeline centrally on Google’s servers, Google said the information would be stored on the user’s device.

Google’s public explanation emphasized privacy and customer control. The company said putting Timeline on the device would give users “even more control” over this personal information. Location History was already opt-in and off by default.

There was another consequence, and it was a big one.

Once Google no longer possessed a giant centralized repository of users’ Location History, police could no longer hand Google a circle and a time period and have it search that repository for everybody inside.

Reporting at the time suggested that was not an accidental side effect. Forbes reported that a Google employee said that, along with the privacy benefits, the change was intended specifically to bring an end to these broad location searches. Google’s public announcement itself did not say that, so I wouldn’t put words in Google’s mouth. But the practical result is beyond dispute.

The migration took time. By July 2025, according to Google and the Supreme Court, Location History was being stored on individual devices rather than Google’s servers. Google told the Court that it was therefore no longer capable of responding to geofence warrants seeking that Location History data.

In other words, Google leapfrogged SCOTUS and redesigned where location evidence was stored.

Then SCOTUS arrived. On June 29, 2026, the Supreme Court decided Chatrie v. United States.

The case arose from a 2019 Virginia credit union robbery. Investigators did not initially know who the robber was. They obtained a geofence warrant directing Google to search Location History information for devices in the area with a 150-meter radius around the building during the relevant period. That process eventually helped identify Okello Chatrie.

The Supreme Court held that police conducted a Fourth Amendment search when they acquired Chatrie’s location information from Google, because a person has a reasonable expectation of privacy in his cellphone location information.

That’s significant., but it is narrower than saying, “The Supreme Court outlawed geofence warrants.” It didn’t.

The Court did not decide that every conceivable geofence warrant is unconstitutional, nor did it finally resolve whether the particular warrant in Chatrie satisfied all the requirements of the Fourth Amendment. Those questions remain more complicated.

And there is a touch of technological irony here. Justice Alito’s dissent actually called the Google procedure before the Court “now-obsolete.”

Rarely does technology have the courtesy to become obsolete while the Supreme Court is still writing the opinion.

So, are geofence warrants dead?

Google’s classic Location History geofence warrant largely is, but geofencing itself isn’t. Reverse-location searching isn’t necessarily, either.

Incidentally, Apple isn’t an alternative source for the same information. Apple says it has no data to provide in response to geofence requests. At least as far back as 2015, Apple was telling law enforcement that it did not track the geolocation of individual devices or retain GPS information for a specific device or user. An iPhone may know a great deal about where it has been. That doesn’t necessarily mean Apple does.

Other companies, however, may hold different kinds of location data that law enforcement can seek. Telecommunications carriers, app providers, ride-sharing companies and other services can possess records tied to where a device or account was at a particular time. Those systems are technically different from Google’s old Location History database, and they should not all be lumped together simply because somebody draws a circle on a map.

More important for lawyers, location evidence itself certainly hasn’t gone away.

Phones still contain or generate GPS information, Wi-Fi and Bluetooth data, application location records, photographs with location metadata, navigation history and other traces that may help answer the familiar question: Where was this phone?

But the source matters. So does the acquisition method.

A targeted search warrant for a known person’s records is not a Google geofence warrant. Location evidence extracted from a seized phone isn’t one either. Cell-site records aren’t Google Location History. A map with a dot on it may look wonderfully definitive on television, but the underlying technology determines what that dot actually means.

That is where the forensic work begins.

The map still isn’t the territory

Whatever Chatrie ultimately does to Fourth Amendment law, the forensic caution remains the same.

Location data can be remarkably powerful, and it can also be remarkably easy to oversell. A coordinate may carry an accuracy estimate. Different technologies derive location differently. A phone in a building is not necessarily a person in a particular room, and a dot on a map did not acquire certainty merely because PowerPoint made it red.

Ask where the location came from. Ask how it was collected. Get the underlying records and available accuracy information rather than relying solely on the tidy map someone prepared from them.

The old Google geofence may have gone away before the Supreme Court could finish arguing about it. The larger question has not:

When a phone tells us where it was, exactly what does it know, who else can get that information, and how certain should we be? Or, as The Bard might have imagined: To be there or not to be there: that is the geofence question. The forensic question is how well the data can answer it.

When has location data in one of your cases turned out to say less, or more, than everyone first assumed?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Geofence Warrants After Chatrie: SCOTUS Ruled on a Search Google Already Killed appeared first on Burgess Forensics.

The messages were set to delete within an hour, and some of those settings were changed after a litigation hold had already landed. That was really the whole idea.

If you practice long enough, you learn that the tools change but human nature doesn’t. Caveguy Ugg didn’t want anyone to know where he buried the mammoth haunch. Today the digging stick is a setting inside Signal, and the dirt is a “disappearing messages” timer. Same instinct, better encryption.

A million years post-Ugg, the same instinct turns up in the Delaware Court of Chancery. It’s a decision worth reading once, and worth repeating to a client twice.

Wait, isn’t the whole point of an encrypted app that the messages are gone?

Gone from the phone, maybe. Not gone from your obligations.

In In re World Wrestling Entertainment, Inc. Merger Litigation (Del. Ch., May 2026), Vice Chancellor Laster addressed exactly this. Senior people ran Signal with auto-delete turned on, after receiving litigation holds, several manually changed individual chats so messages would disappear in a little less than an hour. The court didn’t shrug. The court held that the first hold already reached Signal communications that overlapped with the potential deal. And even apart from the hold, it found that the duty to preserve sale-related evidence had arisen by August 31, 2022. That was months before the later sale-process hold. Sophisticated parties in that situation should reasonably have anticipated litigation.

The line worth taping to your monitor: litigation holds are not self-executing. Sending the memo, and even making sure they got it, is not the same as preserving the data. Somebody has to identify the relevant apps and devices, verify the settings, and actually disable the auto-deleted function.

So, what did it cost them?

The court didn’t reach for the biggest hammer. Rather than make a default judgment or give a blanket “assume the worst” instruction to a jury, it did something more surgical. It was arguably more dangerous for the sanctioned side: it presumed certain specific facts to be true and then shifted the burden, requiring the defense to overcome those presumptions by clear and convincing evidence rather than the usual preponderance. A bit of a switcheroo on the usual burden of proof ground floor.

Read that again if you litigate. The evidentiary floor moved. That’s not a slap on the wrist.

Now, I’m a forensic examiner, not a lawyer, and the doctrine here (when the duty attaches, what sanction fits) is your department, and it varies by jurisdiction. What I can tell you is the part that lives on my side of the table: how this actually plays out in the data.

Can’t your people just recover the deleted Signal messages?

Sometimes, but not always, and not the way Professor Google’s many advisors say. Here’s what’s real.

Disappearing-message apps are built to leave little behind, but “little” is not “nothing.” Copies and traces have a way of surviving in places people forget. A forensic acquisition or Signal backup made while the data still existed. The conversation on another participant’s or linked device where some data has survived. A screenshot somebody took. Notification artifacts preserved elsewhere. A message quoted in an email. Encryption is a strong lock on the message itself. It does nothing about the copies that already walked out the door and went for a jog.

But if the content is truly gone, the forensics may not bring back the words. This matters much for setting expectations with a client. What may be able to show is the activity on the device or app artifacts: that an app was installed, that auto-delete was switched on, that a timer was shortened at a telling moment. Note that we’re talking about what the device did, not who was holding it. Putting a specific person at the keyboard is a separate and much harder question. But in a spoliation fight, showing that a message was set to vanish, and when the setting changed, can matter as much as the words that vanished.

So, what to do?

If you represent the party with the duty, the practical steps are unglamorous and they work.

Identify the apps early. Ask, in plain language, what everyone messages on — not just email and texts. Signal, WhatsApp, Snapchat, Teams, the group chat nobody mentions.

Turn off disappearing settings the moment litigation is reasonably foreseeable, and confirm that preservation is actually occurring rather than trusting that the memo did the job.

Preserve any available backups, forensic images, and secondary devices before data rolls off or is overwritten. But don’t assume an ordinary phone backup contains Signal history—or that a Signal backup captured short-lived disappearing messages. It’s a good idea to collect that before today’s backup writes over yesterday’s.

Document your preservation, not just your hold. When someone later asks what you did, “we sent a notice” is a weaker answer than “we sent a notice and confirmed the settings on every device by this date.”

None of this requires a particular level of paranoia. It requires remembering that a message built to vanish can still leave a record of having been built to vanish.

Ever had a “disappearing” conversation turn out not to be the dead end everyone assumed? I’d like to hear how it surfaced.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post When “Auto-Delete” Becomes “Adverse Inference” appeared first on Burgess Forensics.

By Steve Burgess, Burgess Forensics, 2026

“He passed last month, and his whole life is locked inside his phone. Can’t you just get in?”

I hear some version of that rather often —more than you might think, in fact. The request comes from grieving families, from fighting families, and from the attorneys handling their estates.

From the grieving, it’s asked with a kind of hope. It’s as though the phone were a filing cabinet, and I kept the master key in a drawer. From the fighting, it’s asked with a harder edge, and even a kind of unfounded certainty, because by then everyone suspects the phone is holding something someone would rather it didn’t.

Sometimes I can help. Often the honest answer is: it depends on who planned, what’s stored where, and a couple of laws most people have never heard of.

A person’s digital life doesn’t end when they do. It just sits there —email, photos, messages, cloud backups, a crypto wallet, the online business, the loyalty points, the birthday wishes from casual friends who didn’t realize the intended recipient is gone —waiting for someone with the right authority (and sometimes the right password) to come along. The question your client is really asking is who that someone is, and whether the door will open when they get there.

“Isn’t the executor just entitled to all of it?”

Not automatically. This surprises people. Two things do most of the governing here, and they don’t always pull in the same direction.

The first is a federal privacy law, the Stored Communications Act, written in 1986, before almost any of your clients had an email address. In plain terms and except in narrow circumstances, it bars the companies that hold the actual words of emails, messages, and the rest of the electronic communications from handing over the contents. It really doesn’t care that Grandma died and the family is grieving. A provider can face liability for oversharing, so its reflex is “no.”

The second is a state law that most states have now adopted: RUFADAA —the Revised Uniform Fiduciary Access to Digital Assets Act (yes, it’s a mouthful; blame the committee that named it). Drafted by the Uniform Law Commission, it has been adopted in most U.S. states, though details and terminology may vary by jurisdiction. It gives executors, trustees, and agents under a power of attorney a legal path to a decedent’s digital assets while carving out those private communications for extra protection, to stay on the right side of that 1986 federal law.

Now the necessary disclaimer, and I mean it: I’m a forensic examiner, not a lawyer. RUFADAA’s details vary from state to state, so treat what follows as the lay of the land, not legal advice for your jurisdiction —that’s your department (or your attorney’s), not mine. But the structure is worth knowing cold, because it may decide who wins before a referee enters the picture.

The three-rung ladder (and it’s upside down from what people expect)

RUFADAA sets a priority order for who controls an account. Picture a ladder that the platform reads from the top down.

1. The online tool. If the person used a tool the platform itself provides, such as Facebook’s Legacy Contact, Google’s Inactive Account Manager, Apple’s Digital Legacy, then that choice sits on the top rung. It can even override a contradictory will. Let that land: a two-minute setting on a phone can outrank a document a lawyer carefully drafted.
2. The estate documents. No online tool? Then the directions in the will, trust, or power of attorney control who gets what, which is exactly why explicit “digital assets” language belongs in those documents now, not someday.
3. The fine print. Nothing from above? Then the platform’s terms of service decide. But note that those were written to protect the platform, not your client’s heirs.

Most people are sitting on rung three without knowing it.

So, what do the big platforms actually do?

• Apple’s Digital Legacy can provide a designated Legacy Contact access to eligible Apple Account data, such as certain iCloud-stored photos, files, notes, messages, and device backups, after Apple approves a request supported by the access key and proof of death. It does not provide the decedent’s device passcode or decrypt a passcode-locked device, although Apple can remove Activation Lock. It’s one of the more generous setups, though. One caveat: if a paid iCloud+ account stops being paid, Apple does not guarantee indefinite preservation of data exceeding the free storage allowance and reserves the right to restrict access to or delete stored content.
• Google’s Inactive Account Manager is triggered by inactivity, not death. Set a window, say, three or eighteen months, and Google will either share the data you chose with the people you named, or delete the account. If nobody set it up, the family is left negotiating with support. Inactive Account Manager is an access plan, not a preservation plan: Google’s separate inactivity and storage-quota deletion policies still apply.
• Facebook memorializes an account once it learns of a death, and a Legacy Contact can tend that memorial page, but Facebook does not hand over private messages. Full stop.

The pattern: the cloud is a locked building, and every landlord has its own rules for who gets a key, and which rooms that key opens.

Note that companies change policies and the above are accurate as of the writing of this article.

“What if I need it for a case, not the estate?”

This is where the fighting families come in. Same walls, different reason for wanting in. When a decedent’s texts or emails matter to a wrongful-death claim, a probate contest, or a business dispute, a subpoena to the provider still runs headfirst into the Stored Communications Act on content. Still, a properly authorized fiduciary may have a stronger route to a catalogue of communications or other non-content records than to message content, though providers may require formal documentation and may impose statutory or policy-based conditions.

Which is why, in my line of work, the device usually beats the cloud. A phone, laptop, or backup that’s lawfully in the estate’s possession, when examined with proper authority, frequently holds the messages, photos, and app data the platform won’t volunteer, plus deleted material that never made it into any legacy tool.

The catch is always the same pair: authority and access. The right to look, and a way in. And that “way in” is the quiet crisis. Desktop and laptop computers, and their physical backup drives, often give the enterprising computer geek a number of ways in. We’re frequently called on to excavate these potentially rich sources: existing files, deleted ones, and former drafts of the very documents and evidence a case turns on.

Phones are another matter. Modern ones are encrypted by default, so without the passcode, a legacy contact, or a good backup, even the family’s own forensic examiner can end up staring at a very expensive brick. (“Encrypted” isn’t always the dead-end people assume —but it isn’t a guarantee either.)

So, what to do?

This is the easy part, and it’s worth handing to clients now rather than litigating later.

• Set the online tools. Apple Digital Legacy, Google Inactive Account Manager, Facebook Legacy Contact. It only takes about five minutes each, and they sit on the top rung of the ladder.
• Put digital assets in the estate plan. Explicit language in the will, trust, and power of attorney authorizing the fiduciary to access digital assets, including the content of communications, is exactly the consent RUFADAA and the SCA are looking for.
• Keep an inventory, not a password list in the will. A will can become a public record; a sealed, separately stored list of accounts and where the keys live does not. Crypto especially. Custodial exchanges may have separate estate-access procedures, subject to identity, probate, and compliance requirements. But self-custodied crypto is unforgiving: no seed phrase or proper login and no crypto coins for you. No exceptions.
• Don’t “clean up” the device. For anything that might become contested, powering through a phone or running a factory reset can destroy evidence. It’s also very likely to raise spoliation questions in a contested case. When in doubt, preserve first and examine later.

The uncomfortable part

Most of us have built a whole second life online without realizing and left no instructions for it. For your clients, a few minutes of planning turns what would have been a legal-and-forensic headache into a routine handoff.

What’s the messiest digital-estate tangle you’ve run into? A locked phone nobody had the code to, a memorialized account, a crypto wallet with no key in sight? I’d like to hear how it played out.

Burgess Forensics: (866) 345-3345  |  steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post What Happens to Your Digital Life When You Die (And Who Can Access It) appeared first on Burgess Forensics.

The format language in a discovery request is easy to skip over. It looks like boilerplate. It reads like boilerplate. It is actually boilerplate. And so it gets waved through: “produce as PDF, that’s fine.” Maybe not so fine when that same attorney later pays me to explain why the file on my screen can’t answer the question the case now turns on.

Here’s the thing the other side already knows: whoever picks the format picks what you get to see. It’s just how the rules work. Under Federal Rule of Civil Procedure 34(b)(2)(E), the party asking for the documents gets to specify the form they arrive in. Don’t specify, and the choice falls to the producing side, with “reasonably usable” form as the only floor — and reasonably usable is a long way from native. Say nothing about format and you’ve handed them the pen.

Native files vs. PDFs sounds like an argument for the IT department, right? It isn’t. It’s one of the quietest, most consequential fights in the whole discovery process, and it’s worth having on purpose.

A PDF is a photograph of a document, not the document

A native file is the thing itself – the spreadsheet with its formulas still doing math, the email with its full routing header, the Word file that still remembers every draft, the photo that quietly wrote down where and when it was taken. I have a paragraph in my engagement letter saying so, albeit a bit more succinctly. A PDF or a TIFF is a picture of that file after someone chose the pose.

What really gets me is when evidence is produced as a printout of a PDF of a scan of a PDF created from the actual original file. Happens all the time. But it’s several steps away from what really happened and far from the metadata that tells the real story.

Such “pictures” drop exactly the parts that tend to win cases. Most of the metadata, describing fields such as who made it, when, on what device, and sometimes where tends to get lost when a PDF is generated from it. This is the difference between “he says he wrote it in March” and knowing, to the minute, that he didn’t.

A spreadsheet may show you a very precise value of 4,203,722.46 in the flattened PDF version but hides the formulae and structure that generated a possibly different number. A document that previously contained all the things people put in a document before they remembered other people would read the tracked changes, comments, hidden rows? Native format keeps them. The flattened copy forgets them, conveniently.

Hash values and container data are integrity signals that may let you and me confirm that the document produced is the same as the original are casualties of a PDF export. It snaps that verification thread and asks you to just take everybody’s word for it instead.

None of it comes back, either. You can’t un-flatten a PDF into the original any more than you can un-fry a flapjack. Once it’s produced that way, the missing data isn’t hiding from you. It’s gone.

I had a case where the “date digitized” EXIF metadata from a series of photos supported one side’s story. However, deeper in the metadata, there was satellite data that cast real doubt on the story being told. Satellites and their atomic clocks don’t lie about the time or the day.

Why the other side is so agreeable about it

Producing in PDF usually isn’t laziness. It’s control wearing the costume of laziness. A flattened production is easier to redact, easier to Bates-stamp, and, in a happy coincidence, easier to sanitize. The timestamp that wrecks the timeline, the author who wasn’t supposed to be within a mile of that memo, the formula that shows how a number really got built: all of it vanishes in the conversion, and it vanishes wearing the respectable coat of “routine document handling” rather than the orange jumpsuit of spoliation.

To be fair, imaged production isn’t always a dodge. Sometimes there are honest reasons for it — privilege review, redacting personal or protected information, or real proportionality under Rule 26(b)(1) when native would cost more than the whole dispute is worth. Those reasons are legitimate. The trick is to make the other side say so out loud, in the protocol, so that “we imaged it” has to be justified rather than simply assumed.

I should be clear that “save as PDF” is also a genuinely lousy way to strip metadata even when someone’s trying to be honest. It leaves things behind and takes things it shouldn’t. But that’s a different article. For today: the party that controls the format controls the evidence, and they know it even if your side doesn’t.

The fight is won in the ESI protocol, not in a motion six months later.

This is the part I most want attorneys to hear. By the time you’re standing in front of a judge complaining about a bad production, you’re asking to redo work the other side has every incentive to slow-walk into the next fiscal year — and you’re explaining to your client why the schedule, and the bill, went sideways. Nobody enjoys that conversation. Least of all the person who once said “PDF is fine.”

So specify the format on the front end, in writing:

• Ask for native formats, with metadata, by default for anything data-rich — spreadsheets, databases, structured exports — with load files that actually carry the field data. Boring to negotiate. Priceless to have.
• Name the metadata fields you want. Custodian, author, created and modified dates, an MD5 or SHA-1 hash, and parent/child relationships so attachments stay tied to their emails. “With metadata” is an invitation for the other side to read the phrase as generously as their conscience allows.
• Reserve the right to request native format for anything produced as an image, and say so up front — so when you invoke it, it’s a term of the deal and not an ambush they get to act wounded about.
• Bring your examiner in before the language is set, not after the production disappoints. Format specs written without technical input have a real talent for asking, very precisely, for the wrong thing.

The bottom line

This is not enhance-the-reflection-in-the-sunglasses forensics. It’s plumbing. It’s unglamorous, it’s easy to skip, and it is very often the only thing standing between evidence you can build a case on and a tidy picture of evidence you have to take on faith.

Courts increasingly expect native production where format carries meaning, and (hopefully) increasingly treat “well, we already gave you a PDF” as the weak answer it is. But you don’t drift there by luck. You get there by treating format as a substantive term of the case — argued with the same seriousness as scope and custodians, and about a thousand times more attention than it usually gets.

Have the fight early. It’s a great deal cheaper than the one you’ll have later, in front of a judge, with your client and their checkbook watching.

What’s the worst production-format surprise you’ve run into — native you wish you’d demanded, a PDF that turned out to be hiding the whole case, or something else entirely?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Native Files vs. PDFs: Why Discovery Format Fights Are Worth Having appeared first on Burgess Forensics.

A fitness tracker once told me the exact moment its wearer stopped moving. Not slowed down. Stopped. The device wasn’t built to establish a time of death. It was builtto count steps and nag its owner about standing up more often. But it kept a continuous record, and that record answered a question nobody had thought to ask it.

I can’t reveal much about the case. The survivors believed the facility had let conditions get too hot for too long with too little warning. The other side believed close to the opposite: that the tracker’s own history showed the deceased knew better than to push that hard through a changing but controlled environment. Both sides were arguing about the same person’s habits, and the tracker had a record of them. Dueling cardiologists reached differing conclusions about the fitness level of the deceased.

I did not expect a line chart to affect me. Heart rate climbing to a dangerous peak, dropping to zero, then flat and never moving again. Plain as any spreadsheet. Then I imagined what that jagged line meant on the floor of the event.

That case is the whole of digital forensics in one artifact. People imagine this work is about clever adversaries planting evidence. I hear that concern regularly, and it is rarely what actually happened. The real story is duller and much harder to argue with: an ordinary device did exactly what it was built to do, and nobody remembered that what it was built to do includes keeping a record.

Your house is full of these. A video doorbell logs every motion event with a timestamp, whether or not itsaved any video.A voice assistant logs when it woke up, and sometimes what it heard in the few seconds on either side, depending on a setting its owner has never opened or knew existed. A thermostat infers occupancy from temperature adjustments and motion, which turns out to be a decent proxy for whether anyone was home. A robot vacuum holds a floor plan of every room it has ever cleaned. A car knows where it went and how fast it got there. It is getting harder and harder to have a good ol’ dumb home.

None of this was designed to be evidence, which is one reason it can become powerful evidence when properly authenticated and interpreted. There may still be questions about reliability, chain of custody, retention settings, incomplete logs, and similar issues, but the device itself has no made-up story to keep straight. It is not shaped by human memory in the way witness recollection is, though it still has to be interpreted carefully. Someone can be careful about what they say out loud and still be wearing a watch that logged a heart rate spike at the moment in question.

The law is still catching up. Carpenter v. United States narrowed the old assumption that anything you hand to a company is fair game without a warrant, at least for cell site location records. Aside from preservation duties, discovery scope, and the need to meet and confer, there is a live question whether that reasoning will narrow access to data from a thermostat, a vacuum’s floor map, or a year of refrigerator door-open events. Those boundaries are being worked out one motion and one court at a time as we speak. I would not bet on the answers looking the same in five years as they do today.

For lawyers, the lesson is simple: ask early what connected devices were present, where the data is stored, how long it is retained, and who controls it.

In the meantime, the practical reality is simpler. Your home has more employees than you think, and all of them are taking notes. None of it is malicious. Much of it may be discoverable or obtainable, if someone thinks to ask.

What smart-device data point has surprised you most, in a case or in your own house? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Your Smart Home Is Testifying Against You appeared first on Burgess Forensics.

Twenty years ago, a forensic report about a hard drive was mostly an argument about whether a file existed and when it was last touched. And of course, trying to recover deleted material. Today the same report might need to address whether a video is real, whether a document was generated by a language model, whether a “deleted” text message ever really existed on the device in the first place, and especially, whether the tool used to answer any of those questions is itself reliable enough to stand behind in front of a jury.

It doesn’t come up in every case, but when it does, we’d better be ready to answer. Digital forensics has always rested on the idea that a method can be explained, tested, and challenged — that’s pretty much the whole premise behind Daubert and Frye. AI-assisted analysis complicates that premise, because a growing number of detection and authentication tools now involve models whose internal reasoning isn’t fully visible even to the people who built them. Courts are already grappling with what that means for the right to confront the basis of evidence against you, and there isn’t yet a settled answer For instance, I’ve seen questions about whether Cellebrite might mis‑label a recovered file as‘deleted’ or treat an active file as if ithad been deleted, even though the platform is historically solid and time‑tested in most other respects. Still, that’s not a hypothetical academic question; it’s a live one working its way through appellate opinions right now and it’s going to shape how expert reports get written well into the future.

What’s changing on the ground, in the meantime, is the volume and variety of source data an expert has to account for. A phone used to mean call logs and texts. Now it means cloud-synced photo libraries, health data, smart-home integration logs, location history from a dozen apps that nobody remembers granting permission to (or maybe that an update changed the permissions you did or did not grant, and metadata trails that span devices the owner may not even still possess. The expert’s job isn’t just extraction anymore — it’s building a coherent, defensible narrative out of data that lives in more places than any one device.

The next several years will bring a few concrete shifts. Although there will certainly be changing laws for changing environments, standards bodies and courts will move, slowly and , toward requiring more explicit validation testimony for AI-assisted tools. Not just “the software said so,” but documented error rates, testing methodology, and version-specific behavior, the same rigor that’s long been expected of DNA analysis and toxicology. Authentication of video and audio is going to become its own specialized sub-field, distinct from general digital forensics, the

way arson investigation split off from general fire science. And attorneys are going to need to get comfortable asking experts pointed questions about tool provenance — not because they distrust the expert, but because opposing counsel increasingly will.

None of this replaces the fundamentals. A well-documented chain of custody still matters. So does a methodology that can be explained in plain English to twelve people, a judge, and possibly an attorney who’ve never heard of a hash value, and an expert willing to say plainly what the evidence does and doesn’t show — that hasn’t changed and I don’t expect it to. What’s changing is the amount of homework required to get there, and how much of that homework now involves tools that didn’t exist five years ago.I’d like to makethis the first in a short series looking at where this field is actually headed, drawing on conversations with people building the tools and writing the standards rather than just my own two cents.

If there’s a specific angle—AI detection reliability, Confrontation Clause questions, how courts are handling deepfake authentication—you’d like covered first, I’m glad to hear it. Trial lawyers and judges who live with these issues every day are exactly who I’m hoping to hear from, so please let me know.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Future of Expert Testimony in a Digital World appeared first on Burgess Forensics.

Your client didn’t leak anything on purpose. That’s usually how it goes. The confidential settlement number, the internal complaint about a coworker, the photo that was supposed to prove they were out of town — all of it can arrive at opposing counsel’s desk wrapped in a bow, because nobody thought to ask what was riding along with the file.

Metadata is the paperwork a document fills out about itself. Every photo carries a record of when and where it was taken, and often what device took it.Every Word document remembers who created it, who edited it, and sometimes what earlier drafts looked like — because “track changes” doesn’t always mean what people think it means. Every email carries routing information that shows exactly which server it passed through and when, which is a problem if someone’s story about when they “first learned” something doesn’t match the timestamps.

I’ve spent more hours than I’d like counting looking at metadata that a client’s own attorney didn’t know was there. A “final” contract whose revision history documented every negotiating position the client took before landing on the last one. A deposition exhibit — a screenshot, no less — whose EXIF data placed the photo three weeks earlier and 200 miles away from where the witness swore it was taken.

None of this requires opposing counsel to be Sam Spade. It requires them to right-click and select “Properties,” or open the file in a tool built for exactly this purpose. Metadata review is the price of admission in any competent discovery practice now, and if your side isn’t doing it, you can safely assume the other side is.

The fix isn’t complicated, but it does require actually doing it before production, not after a client calls you in a panic. Native files should be scrubbed of unnecessary metadata before they go out the door, using proper redaction and metadata-removal tools — not just “save as PDF” and hope for the best, because that conversion process is notoriously bad at actually stripping what needs stripping. Track changes and comments need to be resolved and cleared, not just hidden from the default view. Photos being produced as exhibits should have their embedded location and device data reviewed before anyone decides whether that data helps or hurts the case — because sometimes it helps. You don’t want to accidentally destroy evidence (or let your client do it accidentally on purpose) when you’re just trying to be tidy. Frankly, destroying evidence when litigation is anticipated is a very large no-no at which a judge may frown deeply – sometimes with sanctions.

The flip side of all this, of course, is that the same sloppiness that burns your client can work in your favor against the other side. A produced document with intact metadata is a gift. It tells you who really wrote it, when, and whether the “contemporaneous” memo was actually drafted three days after the fact. I’ve had more than one case where a “Created” timestamp that didn’t match anyone’s testimony blew the case open.

The broader point is that a document isn’t just what you can see on the screen. It’s a small forensic record of its own life, and that record travels with it whether anyone remembers to look or not. Attorneys who treat metadata review as a routine part of both production and receipt catch things that attorneys who don’t simply never see.

What’s the closest call you’ve had — metadata that almost went out the door, or metadata you caught on the other side that changed the case?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Metadata Your Client Is Accidentally Sending to Opposing Counsel appeared first on Burgess Forensics.