TV has made digital forensics seem like it’s a piece of cake—all you have to do is lean toward a blurry security camera frame, say “Enhance,” and it will work. Every time. (At least on CSI.)

In honor of the week, here are a few things television has taught the public about digital forensics, along with what actually happens in the real world.

“Enhance.”
On TV, three keystrokes turn 40 pixels of smudge into a readable license plate. And then the computer instantly gives up the name, age, address, and next of kin for who it’s licensed to. In real life, you can’t recover detail the camera never captured. Enhance a smudge and you get a bigger smudge. (A very well-documented bigger smudge, but still.)The 30-second hack.
Hoodie, dark room, green text scrolling, “I’m in. The perp is on Hollywood & Vine and has a small thermonuclear warhead in his backpack. Get on it, STAT!” In real life, a forensic image of a phone can take hours, it has to be in the examiner’s hands, and reviewing what comes out of it can take days. The green text is optional.Deleted means gone.
The TV villain deletes a file and pours a drink. Not on the keyboard. Deleting a file is more like taking the name off a mailbox. The house is still standing until somebody new moves in, and there may be copies in the cloud, on a backup, or on the phone of the person who received it.

Results before the commercial break.
Real forensic work runs on chain of custody, hash values, validated tools, and documentation that would put a prime-time audience to sleep. That’s the point. It’s what holds up when the other side’s expert goes through it line by line. The documentation, not the TV script.

The expert always works for the good guys.
On TV, the real expert works for the good guys and the bad guy’s expert is always overconfident In real life, the evidence doesn’t know who hired you, and the examiner shouldn’t care. The data is the data, and it shows what it shows.My favorite TV forensic tech.
Numb3rs, Season 2, Episode 8, “In Plain Sight.” Amita Ramanujan opens the top casing plate of the hard drive (exposing the magnetic platters to open air – this is such a no-no!) and proceeds to wave a handheld magnetic sensor wand over the open spinning disks while Charlie watches the data flow onto the display screen. Oh, how I wish!Forensic science is slower and less photogenic than television. It’s also more interesting, because it’s real. Really.

#ForensicScienceWeek #DigitalForensics #eDiscovery #ExpertWitness

The post Happy Forensic Science Week! appeared first on Burgess Forensics.

Deleting the messages was the cheap part.

I recently wrote about sanctions: the adverse-inference instruction, the spoliation finding, the judge with disapproval written all over his face telling the jury it may assume the worst about whatever got erased. That’s a high price to pay for hitting delete. It can cost real money, and sometimes much more. Sometimes it ends up costing the whole case. But the courtroom is not necessarily where the biggest bills come due.

Regulators send a different kind of invoice, and they can send a lot of them.

The three-billion-dollar housekeeping problem

Since December 2021, the SEC and the CFTC have been running a sweep, collecting what they politely call “off-channel communications.” Translation: business talk that happened on personal phones, in texts, in WhatsApp, in Signal, in whatever app someone reached for instead of the monitored work system. The firms were supposed to keep those records. They didn’t. So, the messages weren’t there when the regulators came looking. Toll calls, indeed.

The tab so far is north of $3 billion in combined penalties across more than 100 firms. It started small and almost quaint: JPMorgan, December 2021, a $125 million (okay, not so small to you and me) WhatsApp recordkeeping fine that looked at the time like a warning shot. It wasn’t a warning shot – it was just the opening bid.

And here’s the part attorneys may want to pay close attention to. The enforcement that hit the institutions is now working its way down to individuals. FINRA has picked up the baton and started suspending individual brokers for the same conduct. It’s been often said that all business is personal, but they didn’t mean penalties. Those corporate penalties are becoming personal. That text you fired off from your own phone doesn’t just belong to your employer’s compliance headache anymore.

One fine, for the deletion alone

Now a hop across the pond to Brussels for a clean illustration of the principle in Europe.

In June 2024 the European Commission fined International Flavors & Fragrances €15.9 million for obstructing an antitrust inspection. The underlying investigation into the fragrance industry is a separate matter and is still open as of IFF’s June 2026 filing. What earned the fine was this: during a 2023 dawn raid, while the Commission was reviewing employees’ mobile phones, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was underway.

Very bad timing. Not before. He deleted them after being told an inspection was happening.

It was the first time the Commission ever fined a company for deleting messages off a phone. And note the arithmetic, because it’s the whole thesis of this piece: the fine was set as a percentage of IFF’s total worldwide turnover, then cut in half because the company owned up and helped recover the data. The fine did not depend on proving that the messages established the suspected antitrust violation. The deletion itself was the offense.

“But the messages are gone. How do they even know?”

This is the question many ask, usually with real hope in their voice. It rests on the myth that a deleted message is a deleted event.

It isn’t. A message is not a single object sitting in one place. It’s an event that leaves marks in several places at once, most of them outside the sender’s reach.

Delete a text and the content may vanish from the handset (although it might also be recoverable from there), but the carrier may still maintain transaction records for an SMS or MMS, logging that a message moved from one number to another at a particular minute. That metadata won’t tell anyone what was said but it will tell an investigator that something was said, to whom, and when, and that is often more than enough. For encrypted apps that don’t use the carrier’s messaging service, evidence may exist elsewhere: in an enabled backup, in forensic remnants that may still be recoverable from the device, or on the other person’s phone.

That last one is the reversal worth dwelling on. In my usual line of work, “we have the logs” is what my side says when we’ve preserved the evidence, and the other side is squirming. In these cases it’s turned around. The logs that sink you are the ones the other side kept. Two firms message off-channel; one of them preserved its half of the conversation, and now the gap on the second firm’s system isn’t just a gap, it’s a documented absence with a matching record on the far end. The counterparty becomes the witness. In the fragrance case, the Commission caught the deletion during the raid and the deleted data was recovered through the backup system anyway. The employee erased his handset copy. He did not erase IFF’s backup.

Existence outlives content. That’s the line to remember. Should be the title of a book.

“Isn’t a fine just the cost of doing business?”

Some firms clearly treated the recordkeeping rules that way, right up until the number had ten figures in it. But there’s a subtler trap. When the deletion itself becomes the sanctionable act, the cooperation math changes. IFF’s fine got halved for coming clean and helping recover the data. The deletion still cost them eight figures. Without that cooperation, the Commission’s starting figure was twice as high. There’s no version of that ledger where hitting delete comes out ahead.

“My client isn’t a Wall Street bank or a fragrance conglomerate.”

Well, of course it’s not. But the logic doesn’t live in securities law or EU competition rules. It lives in one idea that runs through all of it: destroying evidence after you’re on notice is a separate wrong from whatever the evidence would have shown, and it carries its own separate price. Regulators call it obstruction. Judges call it spoliation. The custodian who cleaned up their phone the weekend after the litigation hold arrived is standing in the same spot as that senior employee in the fragrance case, minus the corporate turnover to cushion the landing.

So, what to do?

Nothing exotic. The unglamorous stuff, done early.

Preserve on notice. We know this goes without saying, but given that it’s still an issue, we’re saying it anyway. In U.S. civil litigation, the duty to preserve relevant evidence generally arises when litigation is reasonably foreseeable. If auto-delete settings can affect information in scope, suspend them.

Assume the other side kept their copy. Advise clients as though the counterparty preserved everything, because sometimes they did. A story that depends on a message never having existed is a story with a short shelf life. Hope and reality can be two very different things.

Preserve the phones before they’re “cleaned up.” Deleted-but-recoverable data may have a narrow window. It can disappear when the device is wiped, traded in, or overwritten through continued use or backup rotation. Phones also perform their own internal clean-up, so time matters. Preserve the device promptly, then have counsel and a qualified examiner determine the appropriate scope and acquisition method.

Don’t confuse encrypted with gone. Signal and similar apps can make content harder to recover, but encryption does not eliminate every potential source. Depending on the app and its settings, evidence may remain in an enabled backup, a screenshot, or a recipient’s device.

Deleting evidence can create consequences on several legal tracks. A court may impose remedies for spoliation, while a regulator may pursue recordkeeping violations or obstruction. Those categories can overlap, and the available penalties depend on the facts and the forum. What they share is that the deletion can become a problem of its own, apart from whatever the missing messages might have shown.

Ever had a “the messages are gone” case turn out to be nothing of the sort once you looked at the other side’s devices? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Sources: European Commission press release, IFF €15.9M (June 2024) · Holland & Knight, SEC/CFTC off-channel enforcement totals · Ex-Wells Fargo Broker Fined, Suspended for Off-Channel Texts to Colleague

The post Auto-Delete, Take Two: Regulatory Fines Can Dwarf Sanctions appeared first on Burgess Forensics.

Your client didn’t leak anything on purpose. That’s usually how it goes. The confidential settlement number, the internal complaint about a coworker, the photo that was supposed to prove they were out of town — all of it can arrive at opposing counsel’s desk wrapped in a bow, because nobody thought to ask what was riding along with the file.

Metadata is the paperwork a document fills out about itself. Every photo carries a record of when and where it was taken, and often what device took it.Every Word document remembers who created it, who edited it, and sometimes what earlier drafts looked like — because “track changes” doesn’t always mean what people think it means. Every email carries routing information that shows exactly which server it passed through and when, which is a problem if someone’s story about when they “first learned” something doesn’t match the timestamps.

I’ve spent more hours than I’d like counting looking at metadata that a client’s own attorney didn’t know was there. A “final” contract whose revision history documented every negotiating position the client took before landing on the last one. A deposition exhibit — a screenshot, no less — whose EXIF data placed the photo three weeks earlier and 200 miles away from where the witness swore it was taken.

None of this requires opposing counsel to be Sam Spade. It requires them to right-click and select “Properties,” or open the file in a tool built for exactly this purpose. Metadata review is the price of admission in any competent discovery practice now, and if your side isn’t doing it, you can safely assume the other side is.

The fix isn’t complicated, but it does require actually doing it before production, not after a client calls you in a panic. Native files should be scrubbed of unnecessary metadata before they go out the door, using proper redaction and metadata-removal tools — not just “save as PDF” and hope for the best, because that conversion process is notoriously bad at actually stripping what needs stripping. Track changes and comments need to be resolved and cleared, not just hidden from the default view. Photos being produced as exhibits should have their embedded location and device data reviewed before anyone decides whether that data helps or hurts the case — because sometimes it helps. You don’t want to accidentally destroy evidence (or let your client do it accidentally on purpose) when you’re just trying to be tidy. Frankly, destroying evidence when litigation is anticipated is a very large no-no at which a judge may frown deeply – sometimes with sanctions.

The flip side of all this, of course, is that the same sloppiness that burns your client can work in your favor against the other side. A produced document with intact metadata is a gift. It tells you who really wrote it, when, and whether the “contemporaneous” memo was actually drafted three days after the fact. I’ve had more than one case where a “Created” timestamp that didn’t match anyone’s testimony blew the case open.

The broader point is that a document isn’t just what you can see on the screen. It’s a small forensic record of its own life, and that record travels with it whether anyone remembers to look or not. Attorneys who treat metadata review as a routine part of both production and receipt catch things that attorneys who don’t simply never see.

What’s the closest call you’ve had — metadata that almost went out the door, or metadata you caught on the other side that changed the case?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Metadata Your Client Is Accidentally Sending to Opposing Counsel appeared first on Burgess Forensics.