By Steve Burgess, Burgess Forensics, 2026

“He passed last month, and his whole life is locked inside his phone. Can’t you just get in?”

I hear some version of that rather often —more than you might think, in fact. The request comes from grieving families, from fighting families, and from the attorneys handling their estates.

From the grieving, it’s asked with a kind of hope. It’s as though the phone were a filing cabinet, and I kept the master key in a drawer. From the fighting, it’s asked with a harder edge, and even a kind of unfounded certainty, because by then everyone suspects the phone is holding something someone would rather it didn’t.

Sometimes I can help. Often the honest answer is: it depends on who planned, what’s stored where, and a couple of laws most people have never heard of.

A person’s digital life doesn’t end when they do. It just sits there —email, photos, messages, cloud backups, a crypto wallet, the online business, the loyalty points, the birthday wishes from casual friends who didn’t realize the intended recipient is gone —waiting for someone with the right authority (and sometimes the right password) to come along. The question your client is really asking is who that someone is, and whether the door will open when they get there.

“Isn’t the executor just entitled to all of it?”

Not automatically. This surprises people. Two things do most of the governing here, and they don’t always pull in the same direction.

The first is a federal privacy law, the Stored Communications Act, written in 1986, before almost any of your clients had an email address. In plain terms and except in narrow circumstances, it bars the companies that hold the actual words of emails, messages, and the rest of the electronic communications from handing over the contents. It really doesn’t care that Grandma died and the family is grieving. A provider can face liability for oversharing, so its reflex is “no.”

The second is a state law that most states have now adopted: RUFADAA —the Revised Uniform Fiduciary Access to Digital Assets Act (yes, it’s a mouthful; blame the committee that named it). Drafted by the Uniform Law Commission, it has been adopted in most U.S. states, though details and terminology may vary by jurisdiction. It gives executors, trustees, and agents under a power of attorney a legal path to a decedent’s digital assets while carving out those private communications for extra protection, to stay on the right side of that 1986 federal law.

Now the necessary disclaimer, and I mean it: I’m a forensic examiner, not a lawyer. RUFADAA’s details vary from state to state, so treat what follows as the lay of the land, not legal advice for your jurisdiction —that’s your department (or your attorney’s), not mine. But the structure is worth knowing cold, because it may decide who wins before a referee enters the picture.

The three-rung ladder (and it’s upside down from what people expect)

RUFADAA sets a priority order for who controls an account. Picture a ladder that the platform reads from the top down.

1. The online tool. If the person used a tool the platform itself provides, such as Facebook’s Legacy Contact, Google’s Inactive Account Manager, Apple’s Digital Legacy, then that choice sits on the top rung. It can even override a contradictory will. Let that land: a two-minute setting on a phone can outrank a document a lawyer carefully drafted.
2. The estate documents. No online tool? Then the directions in the will, trust, or power of attorney control who gets what, which is exactly why explicit “digital assets” language belongs in those documents now, not someday.
3. The fine print. Nothing from above? Then the platform’s terms of service decide. But note that those were written to protect the platform, not your client’s heirs.

Most people are sitting on rung three without knowing it.

So, what do the big platforms actually do?

• Apple’s Digital Legacy can provide a designated Legacy Contact access to eligible Apple Account data, such as certain iCloud-stored photos, files, notes, messages, and device backups, after Apple approves a request supported by the access key and proof of death. It does not provide the decedent’s device passcode or decrypt a passcode-locked device, although Apple can remove Activation Lock. It’s one of the more generous setups, though. One caveat: if a paid iCloud+ account stops being paid, Apple does not guarantee indefinite preservation of data exceeding the free storage allowance and reserves the right to restrict access to or delete stored content.
• Google’s Inactive Account Manager is triggered by inactivity, not death. Set a window, say, three or eighteen months, and Google will either share the data you chose with the people you named, or delete the account. If nobody set it up, the family is left negotiating with support. Inactive Account Manager is an access plan, not a preservation plan: Google’s separate inactivity and storage-quota deletion policies still apply.
• Facebook memorializes an account once it learns of a death, and a Legacy Contact can tend that memorial page, but Facebook does not hand over private messages. Full stop.

The pattern: the cloud is a locked building, and every landlord has its own rules for who gets a key, and which rooms that key opens.

Note that companies change policies and the above are accurate as of the writing of this article.

“What if I need it for a case, not the estate?”

This is where the fighting families come in. Same walls, different reason for wanting in. When a decedent’s texts or emails matter to a wrongful-death claim, a probate contest, or a business dispute, a subpoena to the provider still runs headfirst into the Stored Communications Act on content. Still, a properly authorized fiduciary may have a stronger route to a catalogue of communications or other non-content records than to message content, though providers may require formal documentation and may impose statutory or policy-based conditions.

Which is why, in my line of work, the device usually beats the cloud. A phone, laptop, or backup that’s lawfully in the estate’s possession, when examined with proper authority, frequently holds the messages, photos, and app data the platform won’t volunteer, plus deleted material that never made it into any legacy tool.

The catch is always the same pair: authority and access. The right to look, and a way in. And that “way in” is the quiet crisis. Desktop and laptop computers, and their physical backup drives, often give the enterprising computer geek a number of ways in. We’re frequently called on to excavate these potentially rich sources: existing files, deleted ones, and former drafts of the very documents and evidence a case turns on.

Phones are another matter. Modern ones are encrypted by default, so without the passcode, a legacy contact, or a good backup, even the family’s own forensic examiner can end up staring at a very expensive brick. (“Encrypted” isn’t always the dead-end people assume —but it isn’t a guarantee either.)

So, what to do?

This is the easy part, and it’s worth handing to clients now rather than litigating later.

• Set the online tools. Apple Digital Legacy, Google Inactive Account Manager, Facebook Legacy Contact. It only takes about five minutes each, and they sit on the top rung of the ladder.
• Put digital assets in the estate plan. Explicit language in the will, trust, and power of attorney authorizing the fiduciary to access digital assets, including the content of communications, is exactly the consent RUFADAA and the SCA are looking for.
• Keep an inventory, not a password list in the will. A will can become a public record; a sealed, separately stored list of accounts and where the keys live does not. Crypto especially. Custodial exchanges may have separate estate-access procedures, subject to identity, probate, and compliance requirements. But self-custodied crypto is unforgiving: no seed phrase or proper login and no crypto coins for you. No exceptions.
• Don’t “clean up” the device. For anything that might become contested, powering through a phone or running a factory reset can destroy evidence. It’s also very likely to raise spoliation questions in a contested case. When in doubt, preserve first and examine later.

The uncomfortable part

Most of us have built a whole second life online without realizing and left no instructions for it. For your clients, a few minutes of planning turns what would have been a legal-and-forensic headache into a routine handoff.

What’s the messiest digital-estate tangle you’ve run into? A locked phone nobody had the code to, a memorialized account, a crypto wallet with no key in sight? I’d like to hear how it played out.

Burgess Forensics: (866) 345-3345  |  steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post What Happens to Your Digital Life When You Die (And Who Can Access It) appeared first on Burgess Forensics.

AI and Elder Abuse, copyright 20025, Steve Burgess

The news is full of AI (Artificial Intelligence) stories. How will it empower us in our jobs? Whose job will it take next? Is it creating actual fake news? 

While there’s a lot of “we’ll see” in the answers to these questions, one immediate and quite pressing issue is how AI is contributing to Elder Abuse. Elder abuse is an action(s) in any relationship where there is an expectation of trust that causes harm or distress to an older person.

American elders were conned out of more than three $3 billion dollars in 2023 in a range of financial crimes, according to the FBI data. AI can make these scammers seem more believable partially because these programs help with content creation and cleaning up human error that might otherwise warn us we’re being served up something fraudulent.

Already, there are so many scams via email, websites, phone calls, advertisements, and offers of romance that there’s plenty to worry about. But does the emergence of AI in everyday life and writing supercharge these efforts to relieve the older amongst us of their carefully husbanded and/or limited resources?

Already, individuals are reaching through our computers and phones to lighten our wallets and bank accounts. There are websites that look like our bank sites, phishing emails that look like they’re from someone or from an institution that we know and trust, ads galore that tempt the reader with promised services, goods, or fortunes.

Already, we give away so much of our privacy in return for the freedom to browse the web and to use other online services. We also regularly share our private information, favorite colors, cars, dates and faces on publicly available social media. But now, there are tools in the guise of fun apps that offer to clean up our photos, or ones to let us have our own voices sing our favorite songs perfectly, our own tin ears notwithstanding.

I see ads every day inviting me to seamlessly insert my voice instead of the original voice – say Sting’s or Sinatra’s, into a popular song. Like karaoke on steroids that we can save and play for or send to others. It’s likely to be fun, but then your voice is being stored in records you have no control over. Thousands of people’s voices are thereby being harvested and stored by some company you don’t know, that has a privacy policy that most of us never read through, and which can be used by these unknown persons in any which way. 

Even if the company offering these services is completely on the up and up, they are a prime target to be hacked by those who would love to use these stored audio clips to clone your voice into realistic but invented audio sent to you via email, or even a phone call.

So what happens when you hear from a beloved grandchild – in their own voices – that they are suffering, or need help out of a jam? And what if you, as a parent, grandparent, or even just a friend, hears from another trusted friend or loved one that they have “such a deal?”

Why, for the cost of nothing at all, you can use chat GPT right now to create a picture of you standing next to the President or your favorite rock star. Some generative AI tools can even create  a video of the two of you singing 70’s rock anthems together.

But nearly as easily, a bad actor could create a picture or audio of your child or friend, needing bail, stuck without airfare far away, injured, in a foreign prison cell, or in the hands of dangerous thugs, begging for your help. 

As technology advances in leaps and bounds, human nature stays much the same. There’s always somebody out to take advantage of the system ,and of you, while we remain always sympathetic to those we care about. The game hasn’t changed – just the tools of the game, and the ease with which the unscrupulous can run their scams on a wider swath of folks. And the tools are ever more easily and cheaply accessible. 

So, what to do?

There are simple steps to make it harder for unscrupulous folks to take advantage. First of all, educate yourself and your elder relations and loved ones about the risks. There’s no need to get paranoid about it – just to take some practical steps.

• DO enable two-factor authentication (2FA) , one of the most important, but simple security practices. 
• DON’T share passwords. (There are a few exceptions for the elderly or ill.)
• DON’T use dictionary words or favorite colors, cars, kids, or teams as your passwords.
• If passwords are hard to remember, DO use password managers, such as NordPass, Dashlane, 1Password, or Last Pass.
• DON’T give away your voice to be recorded by those you don’t know, no matter how much fun it looks like.
• DON’T click on links in emails or texts, especially from financial institutions. Rather, use your browser and type in the website of the institution. Most offer apps for direct access that are generally safe.
• DO look for odd misspellings or extra words in email addresses and domains. Website domains don’t have typos. For instance Welsfargo.com is not Wellsfargo.com (it’s missing an “l.”). Applepayments.com is not Apple.com/payments.
• DON’T open attachments to emails or texts if you’re not sure or don’t know who the sender is.

Modern tech and the Internet make so many things available for us and in many cases, easier for us. While there are always bad actors, and while AI tools make it easier for those bad actors to fool us, some sensible practices make it more difficult for those bad actors to fleece us of our hard-earned resources

Checking up on our elders and educating them about some of these simple steps can make them and you safer, help you both sleep at night, and even bring you a little bit closer, and after all, what could be better than that?

The post AI and Elder Abuse appeared first on Burgess Forensics.