That paperwork is metadata — data about data. And it travels with your files whether or not you invited it along for the trip.

Metadata is the stuff a document quietly jots down while you’re jotting down words. There’s a lot of potential information there: Who created it, when, and on what computer. Who edited it, and when they last saved it . Where a photo was taken, down to the GPS coordinates. What camera, what settings, what software. None of it shows up on the page. All of it comes along, like a stowaway.

Most of the time this is harmless, but occasionally, it’s the whole story.

A photo is a very talkative little file.

Take a picture with your phone and you’ve created a small autobiography. The image, surely, but tucked inside is a section called EXIF data: the make and model of the phone, the date and time down to the second, and, if location services were on, the exact spot on Earth where you stood. Share that photo in its original form and you may be handing over your home address without meaning to.

The good news: most social platforms started stripping this out a few years ago when there was a public hue and cry about it. The bad news: “most” is not “all,” and emailing the original file, or dropping it in a shared folder, sends the whole talkative package along.

Documents keep a diary too

A Word document remembers more than the final draft. Depending on your settings, it can carry the author’s name, the company the software was registered to, how long the file was open, and sometimes, tracked changes and comments you thought you’d removed. Every “on second thought, delete that paragraph” can live on in the file’s memory.

The internet is dotted with cautionary tales of press releases and legal filings that were sent out with the edits still readable underneath. The same is true with newsworthycongressional hearings. Most of us are not popular enough to warrant interest from the government. Still, the words on the page said one thing but the metadata said “here’s what we almost admitted.” Oopsie.

So, what to do?

There’s no need to get paranoid about this. Depending on what you’re shipping for, your grocery list is not a national secret. But a few practical habits go a long way:

• Before sending anything sensitive, look under the hood. In Word on Windows, “Inspect Document” should find and remove hidden data, comments, and tracked changes. Do it on the final version, not the draft.
• Turn off location tagging for your camera if you don’t need it — or scrub EXIF data from photos before sharing the originals. By the way, if litigation is foreseen that involves these photos, don’t scrub the EXIF metadata. It will be considered spoliation of data and will go poorly for you if and when it goes to court.
• Remember that “delete” inside a file often just means “hide.” Removing a comment from view is not always the same as removing it from the file.

None of this requires becoming a hermit. It’s the digital equivalent of checking your pockets before you send the coat to the cleaners.

Metadata isn’t sinister. It’s just honest — sometimes more honest than we’d like. The trick is knowing it’s there, so you decide what to share instead of the file deciding for you.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post The Metadata You Didn’t Know You Were Sending appeared first on Burgess Forensics.

Here’s the thing the other side already knows: whoever picks the format picks what you get to see. It’s just how the rules work. Under Federal Rule of Civil Procedure 34(b)(2)(E), the party asking for the documents gets to specify the form they arrive in. Don’t specify, and the choice falls to the producing side, with “reasonably usable” form as the only floor — and reasonably usable is a long way from native. Say nothing about format and you’ve handed them the pen.

Native files vs. PDFs sounds like an argument for the IT department, right? It isn’t. It’s one of the quietest, most consequential fights in the whole discovery process, and it’s worth having on purpose.

A PDF is a photograph of a document, not the document

A native file is the thing itself – the spreadsheet with its formulas still doing math, the email with its full routing header, the Word file that still remembers every draft, the photo that quietly wrote down where and when it was taken. I have a paragraph in my engagement letter saying so, albeit a bit more succinctly. A PDF or a TIFF is a picture of that file after someone chose the pose.

What really gets me is when evidence is produced as a printout of a PDF of a scan of a PDF created from the actual original file. Happens all the time. But it’s several steps away from what really happened and far from the metadata that tells the real story.

Such “pictures” drop exactly the parts that tend to win cases. Most of the metadata, describing fields such as who made it, when, on what device, and sometimes where tends to get lost when a PDF is generated from it. This is the difference between “he says he wrote it in March” and knowing, to the minute, that he didn’t.

A spreadsheet may show you a very precise value of 4,203,722.46 in the flattened PDF version but hides the formulae and structure that generated a possibly different number. A document that previously contained all the things people put in a document before they remembered other people would read the tracked changes, comments, hidden rows? Native format keeps them. The flattened copy forgets them, conveniently.

Hash values and container data are integrity signals that may let you and me confirm that the document produced is the same as the original are casualties of a PDF export. It snaps that verification thread and asks you to just take everybody’s word for it instead.

None of it comes back, either. You can’t un-flatten a PDF into the original any more than you can un-fry a flapjack. Once it’s produced that way, the missing data isn’t hiding from you. It’s gone.

I had a case where the “date digitized” EXIF metadata from a series of photos supported one side’s story. However, deeper in the metadata, there was satellite data that cast real doubt on the story being told. Satellites and their atomic clocks don’t lie about the time or the day.

Why the other side is so agreeable about it

Producing in PDF usually isn’t laziness. It’s control wearing the costume of laziness. A flattened production is easier to redact, easier to Bates-stamp, and, in a happy coincidence, easier to sanitize. The timestamp that wrecks the timeline, the author who wasn’t supposed to be within a mile of that memo, the formula that shows how a number really got built: all of it vanishes in the conversion, and it vanishes wearing the respectable coat of “routine document handling” rather than the orange jumpsuit of spoliation.

To be fair, imaged production isn’t always a dodge. Sometimes there are honest reasons for it — privilege review, redacting personal or protected information, or real proportionality under Rule 26(b)(1) when native would cost more than the whole dispute is worth. Those reasons are legitimate. The trick is to make the other side say so out loud, in the protocol, so that “we imaged it” has to be justified rather than simply assumed.

I should be clear that “save as PDF” is also a genuinely lousy way to strip metadata even when someone’s trying to be honest. It leaves things behind and takes things it shouldn’t. But that’s a different article. For today: the party that controls the format controls the evidence, and they know it even if your side doesn’t.

The fight is won in the ESI protocol, not in a motion six months later.

This is the part I most want attorneys to hear. By the time you’re standing in front of a judge complaining about a bad production, you’re asking to redo work the other side has every incentive to slow-walk into the next fiscal year — and you’re explaining to your client why the schedule, and the bill, went sideways. Nobody enjoys that conversation. Least of all the person who once said “PDF is fine.”

So specify the format on the front end, in writing:

• Ask for native formats, with metadata, by default for anything data-rich — spreadsheets, databases, structured exports — with load files that actually carry the field data. Boring to negotiate. Priceless to have.
• Name the metadata fields you want. Custodian, author, created and modified dates, an MD5 or SHA-1 hash, and parent/child relationships so attachments stay tied to their emails. “With metadata” is an invitation for the other side to read the phrase as generously as their conscience allows.
• Reserve the right to request native format for anything produced as an image, and say so up front — so when you invoke it, it’s a term of the deal and not an ambush they get to act wounded about.
• Bring your examiner in before the language is set, not after the production disappoints. Format specs written without technical input have a real talent for asking, very precisely, for the wrong thing.

The bottom line

This is not enhance-the-reflection-in-the-sunglasses forensics. It’s plumbing. It’s unglamorous, it’s easy to skip, and it is very often the only thing standing between evidence you can build a case on and a tidy picture of evidence you have to take on faith.

Courts increasingly expect native production where format carries meaning, and (hopefully) increasingly treat “well, we already gave you a PDF” as the weak answer it is. But you don’t drift there by luck. You get there by treating format as a substantive term of the case — argued with the same seriousness as scope and custodians, and about a thousand times more attention than it usually gets.

Have the fight early. It’s a great deal cheaper than the one you’ll have later, in front of a judge, with your client and their checkbook watching.

What’s the worst production-format surprise you’ve run into — native you wish you’d demanded, a PDF that turned out to be hiding the whole case, or something else entirely?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Native Files vs. PDFs: Why Discovery Format Fights Are Worth Having appeared first on Burgess Forensics.

What most people don’t understand is that hitting delete doesn’t erase data. It tells the system that the space can be reused. Think of it less like shredding a document and more like taking the label off a file folder and telling the office it’s okay to reuse the drawer — the pages are still in there until someone actually needs the room and drops the pages in a shredder. Until something overwrites it, the underlying data often sits right where it always was. On phones, computers, and servers, deleted files, messages, and app data are frequently recoverable in whole or in part. While deleted phone data is somewhat more ephemeral and tends to become unrecoverable after a couple of months, other platforms are less so. In many cases, we have recovered them months or even years later.

Still, recoverability is only half of it. The more valuable half is what the act of deletion reveals.

Deletion leaves its own trail. Modern devices tend to be relentless record-keepers. They document nearly everything, often including their own attempted cover-ups. When someone deletes files, wipes an app, clears a chat, or runs “cleaner” or “wiping” software, those actions frequently generate their own artifacts: timestamps, log entries, system events, and traces in backups and cloud sync. In practice, you may be able to prove not just what existed, but when it was removed, and sometimes that a wiping tool was run at 2 a.m. the night before a device was handed over. We had a case where the inspection got stalled for a couple of days to give time for the IT guy to scrub away. However, the file-destroying tool kept a record of every single file it destroyed over the previous very busy nights.

Nothing says “nothing to hide” quite like a freshly installed disk-scrubbing utility. That timeline can be more persuasive to a fact-finder than the deleted content ever would have been.

Intent is the story. A single deleted photo is a fact. A coordinated wipe — messages cleared, a drive reformatted, cloud backups switched off, all clustered around a key date — is a narrative unto itself. Courts have well-developed doctrine here. Spoliation of evidence can support sanctions and, in many jurisdictions, the dreaded adverse-inference instruction: the jury may be told they can assume the destroyed evidence would have hurt the party who destroyed it. The person trying to make the problem disappear might just be manufacturing a bigger one, wrapped up with a bow on top.

The copies that survive. Data rarely lives in one place. A message deleted on a phone may survive in a backup, on the other party’s device, in a cloud account, or on a synced laptop nobody remembered was still logged in. Deleting the local copy does nothing to the dozen copies elsewhere. The modern device can be quite the bothersome gossip –  it tells your secrets to every other device it meets. Part of a competent forensic examination is simply knowing where those copies tend to hide.

Besides the potentially recoverable file being looked for, many programs, especially Microsoft Office, make invisible copies every time a file is open. Invisible to the user, that is – not to the examiner.

So, when the other side deletes everything, they may accomplish three things that help you: they leave recoverable data behind, they create adocumented record of the destruction, and they hand you a consciousness-of-guilt argument you didn’t have before. That’s a rough return on investment for a night or two filled with buckets of coffee and frantic clicking.

A few practical notes for counsel. Move fast. Recoverability drops as devices keep running and space gets overwritten, so preservation letters and litigation holds matter enormously.

Preserve the device itself, not just exports; a proper forensic image captures far more than a manual copy. And loop in an examiner early, before well-meaning IT staff or clients “poke around just to check” and overwrite the very evidence you’re trying to save. Curiosity has damaged more cases than it has solved.

“He deleted everything” isn’t the moment your case falls apart. More often, it’s the moment it gets interesting.

A question for the litigators: what’s a situation you’ve had where deleted data actually strengthened your side of the case? I’d be curious to hear how it played out. The best forensic stories usually start with someone who was very sure they’d covered their tracks.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post Why “He Deleted Everything” Is Usually Good News for Your Case appeared first on Burgess Forensics.

I can’t reveal much about the case. The survivors believed the facility had let conditions get too hot for too long with too little warning. The other side believed close to the opposite: that the tracker’s own history showed the deceased knew better than to push that hard through a changing but controlled environment. Both sides were arguing about the same person’s habits, and the tracker had a record of them. Dueling cardiologists reached differing conclusions about the fitness level of the deceased.

I did not expect a line chart to affect me. Heart rate climbing to a dangerous peak, dropping to zero, then flat and never moving again. Plain as any spreadsheet. Then I imagined what that jagged line meant on the floor of the event.

That case is the whole of digital forensics in one artifact. People imagine this work is about clever adversaries planting evidence. I hear that concern regularly, and it is rarely what actually happened. The real story is duller and much harder to argue with: an ordinary device did exactly what it was built to do, and nobody remembered that what it was built to do includes keeping a record.

Your house is full of these. A video doorbell logs every motion event with a timestamp, whether or not itsaved any video.A voice assistant logs when it woke up, and sometimes what it heard in the few seconds on either side, depending on a setting its owner has never opened or knew existed. A thermostat infers occupancy from temperature adjustments and motion, which turns out to be a decent proxy for whether anyone was home. A robot vacuum holds a floor plan of every room it has ever cleaned. A car knows where it went and how fast it got there. It is getting harder and harder to have a good ol’ dumb home.

None of this was designed to be evidence, which is one reason it can become powerful evidence when properly authenticated and interpreted. There may still be questions about reliability, chain of custody, retention settings, incomplete logs, and similar issues, but the device itself has no made-up story to keep straight. It is not shaped by human memory in the way witness recollection is, though it still has to be interpreted carefully. Someone can be careful about what they say out loud and still be wearing a watch that logged a heart rate spike at the moment in question.

The law is still catching up. Carpenter v. United States narrowed the old assumption that anything you hand to a company is fair game without a warrant, at least for cell site location records. Aside from preservation duties, discovery scope, and the need to meet and confer, there is a live question whether that reasoning will narrow access to data from a thermostat, a vacuum’s floor map, or a year of refrigerator door-open events. Those boundaries are being worked out one motion and one court at a time as we speak. I would not bet on the answers looking the same in five years as they do today.

For lawyers, the lesson is simple: ask early what connected devices were present, where the data is stored, how long it is retained, and who controls it.

In the meantime, the practical reality is simpler. Your home has more employees than you think, and all of them are taking notes. None of it is malicious. Much of it may be discoverable or obtainable, if someone thinks to ask.

What smart-device data point has surprised you most, in a case or in your own house? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Your Smart Home Is Testifying Against You appeared first on Burgess Forensics.

It doesn’t come up in every case, but when it does, we’d better be ready to answer. Digital forensics has always rested on the idea that a method can be explained, tested, and challenged — that’s pretty much the whole premise behind Daubert and Frye. AI-assisted analysis complicates that premise, because a growing number of detection and authentication tools now involve models whose internal reasoning isn’t fully visible even to the people who built them. Courts are already grappling with what that means for the right to confront the basis of evidence against you, and there isn’t yet a settled answer For instance, I’ve seen questions about whether Cellebrite might mis‑label a recovered file as‘deleted’ or treat an active file as if ithad been deleted, even though the platform is historically solid and time‑tested in most other respects. Still, that’s not a hypothetical academic question; it’s a live one working its way through appellate opinions right now and it’s going to shape how expert reports get written well into the future.

What’s changing on the ground, in the meantime, is the volume and variety of source data an expert has to account for. A phone used to mean call logs and texts. Now it means cloud-synced photo libraries, health data, smart-home integration logs, location history from a dozen apps that nobody remembers granting permission to (or maybe that an update changed the permissions you did or did not grant, and metadata trails that span devices the owner may not even still possess. The expert’s job isn’t just extraction anymore — it’s building a coherent, defensible narrative out of data that lives in more places than any one device.

The next several years will bring a few concrete shifts. Although there will certainly be changing laws for changing environments, standards bodies and courts will move, slowly and , toward requiring more explicit validation testimony for AI-assisted tools. Not just “the software said so,” but documented error rates, testing methodology, and version-specific behavior, the same rigor that’s long been expected of DNA analysis and toxicology. Authentication of video and audio is going to become its own specialized sub-field, distinct from general digital forensics, the

way arson investigation split off from general fire science. And attorneys are going to need to get comfortable asking experts pointed questions about tool provenance — not because they distrust the expert, but because opposing counsel increasingly will.

None of this replaces the fundamentals. A well-documented chain of custody still matters. So does a methodology that can be explained in plain English to twelve people, a judge, and possibly an attorney who’ve never heard of a hash value, and an expert willing to say plainly what the evidence does and doesn’t show — that hasn’t changed and I don’t expect it to. What’s changing is the amount of homework required to get there, and how much of that homework now involves tools that didn’t exist five years ago.I’d like to makethis the first in a short series looking at where this field is actually headed, drawing on conversations with people building the tools and writing the standards rather than just my own two cents.

If there’s a specific angle—AI detection reliability, Confrontation Clause questions, how courts are handling deepfake authentication—you’d like covered first, I’m glad to hear it. Trial lawyers and judges who live with these issues every day are exactly who I’m hoping to hear from, so please let me know.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Future of Expert Testimony in a Digital World appeared first on Burgess Forensics.

Metadata is the paperwork a document fills out about itself. Every photo carries a record of when and where it was taken, and often what device took it.Every Word document remembers who created it, who edited it, and sometimes what earlier drafts looked like — because “track changes” doesn’t always mean what people think it means. Every email carries routing information that shows exactly which server it passed through and when, which is a problem if someone’s story about when they “first learned” something doesn’t match the timestamps.

I’ve spent more hours than I’d like counting looking at metadata that a client’s own attorney didn’t know was there. A “final” contract whose revision history documented every negotiating position the client took before landing on the last one. A deposition exhibit — a screenshot, no less — whose EXIF data placed the photo three weeks earlier and 200 miles away from where the witness swore it was taken.

None of this requires opposing counsel to be Sam Spade. It requires them to right-click and select “Properties,” or open the file in a tool built for exactly this purpose. Metadata review is the price of admission in any competent discovery practice now, and if your side isn’t doing it, you can safely assume the other side is.

The fix isn’t complicated, but it does require actually doing it before production, not after a client calls you in a panic. Native files should be scrubbed of unnecessary metadata before they go out the door, using proper redaction and metadata-removal tools — not just “save as PDF” and hope for the best, because that conversion process is notoriously bad at actually stripping what needs stripping. Track changes and comments need to be resolved and cleared, not just hidden from the default view. Photos being produced as exhibits should have their embedded location and device data reviewed before anyone decides whether that data helps or hurts the case — because sometimes it helps. You don’t want to accidentally destroy evidence (or let your client do it accidentally on purpose) when you’re just trying to be tidy. Frankly, destroying evidence when litigation is anticipated is a very large no-no at which a judge may frown deeply – sometimes with sanctions.

The flip side of all this, of course, is that the same sloppiness that burns your client can work in your favor against the other side. A produced document with intact metadata is a gift. It tells you who really wrote it, when, and whether the “contemporaneous” memo was actually drafted three days after the fact. I’ve had more than one case where a “Created” timestamp that didn’t match anyone’s testimony blew the case open.

The broader point is that a document isn’t just what you can see on the screen. It’s a small forensic record of its own life, and that record travels with it whether anyone remembers to look or not. Attorneys who treat metadata review as a routine part of both production and receipt catch things that attorneys who don’t simply never see.

What’s the closest call you’ve had — metadata that almost went out the door, or metadata you caught on the other side that changed the case?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post The Metadata Your Client Is Accidentally Sending to Opposing Counsel appeared first on Burgess Forensics.

Somewhere along the way, text messages became some of the most important evidence in litigation that nobody quite knows how to handle properly. A few years ago, that would have been an email thread, such as in the Case of the Computer That Got Lost.

But in family law and other areas of law, the smoking gun is increasingly a text thread. In employment disputes, it’s a string of after-hours messages between a supervisor and a subordinate. In contract cases, it’s the informal “sounds good, let’s do it” exchange that may or may not constitute an agreement. And in criminal matters, text messages can place someone at a location, establish a relationship, or demonstrate intent in ways that no other evidence can match.

And yet, for something so central to so many cases, the process of getting text messages into evidence in a reliable, authenticated, defensible way remains surprisingly messy.

Let’s start with collection, because that’s where most of the problems begin. When a client tells you they have “all their text messages,” what they usually mean is that they can scroll through their phone and see the conversation. That’s not the same thing. What you’re looking at on the screen is a rendering – the phone’s software deciding how to display a conversation that’s actually stored in a database buried deep in the device’s file system. Screenshots of that rendering are easy to produce, easy to understand, and almost entirely useless from a forensic standpoint.

Why? Because screenshots don’t contain metadata. They don’t show you the underlying database records, the timestamps at the system level, the read receipts, the delivery confirmations, or the message identifiers that can establish when a message was actually sent versus when it appeared on the screen. They also don’t show you what’s been deleted. And they are pretty easy to fabricate. I could create a fake text message conversation in a minute that would be virtually indistinguishable from a real screenshot to the naked eye. People without any particularly special skill set can do the same. Opposing counsel knows this. The judge probably knows this. Your evidence needs to be better than a picture someone took of their own phone.

Side note: it’s kind of shocking when I see that law enforcement has accepted a screenshot as evidence and arrested someone on that basis and the word of the accuser.

A proper forensic extraction pulls the actual database – on an iPhone, that’s the SMS database within the iTunes or Finder backup, or acquired through specialized tools like Cellebrite or GrayKey. On Android devices, the relevant database is typically stored in the device’s data partition. These extractions capture the complete message record: content, timestamps, phone numbers, group message identifiers, attachment references, and in many cases, deleted messages that the user thought were gone.

But here’s where it gets complicated. Not all extractions are created equal. A “logical” extraction is essentially a backup of what the phone makes available through its normal interfaces – it gets you active messages but usually not deleted ones. A “file system” extraction goes deeper, pulling the database files themselves. That difference matters: the deleted message your client swears they never sent, the timestamp that contradicts opposing counsel’s timeline, the metadata that proves a thread is complete – those often live only in the database files a file-system or physical extraction recovers, not in the tidy list a logical backup hands you.

Then there’s the carrier records problem. When forensic extraction of the device isn’t possible – because the phone has been lost, destroyed, wiped, or the owner won’t hand it over – attorneys sometimes turn to carrier records obtained through subpoena. Carrier records can confirm that a message was sent between two numbers at a particular time, but they generally don’t include the content of SMS messages (if a particular carrier retains that, they don’t retain it for long) and they handle MMS and iMessage differently depending on the carrier and the protocol. iMessages, for instance, don’t pass through the carrier’s SMS gateway at all – they travel over Apple’s encrypted servers – so they likely won’t appear in carrier records. If the key evidence is an iMessage thread and the phone is gone, you may have a serious hole in your case unless that message is in an iCloud account that you can access.

Group messages add another layer of complexity. The way group texts are stored and displayed varies between platforms and even between operating system versions. A group message that appears as a single coherent thread on one person’s phone may look completely different on another participant’s phone, depending on their device, their OS version, and whether the messages were sent as SMS, MMS, or through a proprietary protocol like iMessage or RCS. Establishing that everyone in the group saw the same thing requires more work than most people expect. On the other hand, though responsive data may not be found on one person’s device, we might have another crack at the data with the device from someone else in the group.

Authentication is the final hurdle, and it’s where everything we’ve discussed comes together. Under the Federal Rules of Evidence and their state equivalents, you need to establish that the text messages are what you say they are – that they came from the person you claim sent them, that they haven’t been altered, and that the record you’re presenting is complete and accurate. A forensic extraction with proper hash verification, reliable metadata, and chain of custody documentation gets you most of the way there. A screenshot from the client’s phone, standing alone, generally does not.

None of this is meant to suggest that text message evidence is hopeless – far from it. When properly collected, preserved, and authenticated, text messages can be devastating evidence. But the “properly” part requires more planning and technical awareness than many attorneys realize, especially early in the case when preservation decisions are being made and the phone is still in someone’s pocket, quietly syncing, updating, and auto-deleting per whatever settings the user configured and then forgot about.

If text messages matter to your case – and increasingly they do – get a forensic examiner involved early, before devices change hands, before carriers purge their logs, and before your client decides to “clean up” their phone. The evidence is there. You just have to get to it the right way.

What’s the trickiest text message evidence challenge you’ve faced in a case?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Text Messages as Evidence: Harder Than You Think appeared first on Burgess Forensics.

Copyright 2026, Steve Burgess

I’ve sat across the table – or more recently, the Zoom – from a great many attorneys over the past forty years, and I’ve noticed a pattern. Litigators who can cross-examine a hostile witness into a confused puddle, who can recite the rules of evidence from memory, and who can spot a hearsay problem from across the courtroom will sometimes look at a hard drive the way the rest of us look at a tax form: with suspicion, mild dread, and the blessed hope that someone else will handle it.

That’s understandable. Law school doesn’t teach this, and it shouldn’t have to. Digital forensics is its own discipline, just as forensic accounting or medical examination are their own disciplines. But discovery in 2026 runs through digital data so thoroughly that a basic working knowledge isn’t optional anymore. So, let’s cover a few fundamentals – the things many attorneys wish they knew before the discovery clock started running.

Digital evidence is broader than most people think. It’s not just emails and the obvious files on a work computer. It’s text messages, cloud storage, app data, metadata, browser history, location information, IoT (Internet of Things) device logs, and increasingly, AI-generated or AI-assisted content. If a device touches the internet or stores information electronically, it’s a potential evidence source.

I often suggest that clients assume something may be discoverable until proven otherwise, rather than the reverse. That approach occasionally results in collecting more information than you need. The opposite approach occasionally results in explaining things to your client, or worse, to a judge.

Speaking of common misconceptions, let’s talk about deleted data. When a file is deleted on most systems, the data itself usually isn’t immediately erased. Instead, the space it occupied is marked as available for reuse. Until something else overwrites it, some or all of that information may remain recoverable.

That’s often good news. It’s also not a guarantee. How long that recovery window remains open depends on the device, operating system, storage technology, and how much the device has been used since the deletion occurred. Anyone who tells you with complete certainty, as many a client will, that deleted data is “definitely still there” or “definitely gone forever” without examining the device is hand-waving.

Metadata matters more than content sometimes. A document’s content tells you what it says. Its metadata can tell you who created it, when it was created, what software was used, and what happened to it along the way. I’ve seen metadata reveal that a supposedly contemporaneous document was actually created weeks after the event it purported to describe – not a footnote – it can sometimes be the whole case.

Chain of custody sounds like bureaucratic box-checking until you’ve seen a case turn on it. It exists because digital evidence, unlike a paper document, can be altered without leaving an obvious trace if it isn’t handled correctly. A device examined by someone without proper forensic methodology – even with the best intentions – can have its evidentiary value compromised.

This is why “I’ll just have my IT guy take a look” is a sentence that makes me wince every time I hear it. Your IT person may be excellent at fixing printers, managing servers, and keeping everyone connected to Wi-Fi. That’s a different skill set than preserving evidence for litigation. Nobody calls a forensic accountant to repair the office copier, either.

Timing changes everything. The earlier a forensic expert gets involved, the more options exist. Devices keep getting used. Cloud accounts keep syncing. Backups keep cycling and overwriting older versions. Evidence that’s recoverable today may not be recoverable in three months, and there’s rarely a reliable way to know in advance which evidence is on a fast clock and which isn’t. The cost of being wrong is usually much higher than the cost of an early consultation.

None of this requires you to become a forensic examiner yourself – that would be a strange use of your law degree, and frankly I’d be out of a job. What it does require is recognizing when a case has a digital evidence component – which, in 2026, is most of them – and bringing in the right expertise before discovery goes sideways.

The attorneys who get the best outcomes aren’t the ones who know the most about digital forensics. They’re the ones who know enough to ask the right questions at the right time.

What are some things you’ve learned about digital evidence the hard way?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Digital Evidence 101: What Every Attorney Should Know Before Discovery appeared first on Burgess Forensics.

Every so often I’ll sit across the Zoom from an attorney—or from a pro se litigant—who wants everything. Every text message the opposing party has ever sent. Every photo on their phone. Every search query. Every deleted file. Every app. Every cloud account. Of course, I’ve also had those calls where I think they don’t want enough. But they’re the boss here.

In other words, they want the digital equivalent of dumping every piece of dirty clothing on your teenager’s bed to find your missing sock. I understand the impulse. Somewhere in there might be the thing that wins the case.

But “it might be in there somewhere” is not how discovery is supposed to work. It’s also not how a forensic examination should work, because privacy doesn’t evaporate simply because someone becomes a party to a lawsuit.

This tension—between the legitimate need to discover relevant evidence and the very real privacy interests of the person whose device is being examined—sits at the center of much of the work I do. It’s worth understanding how courts actually navigate it, because the answer is more nuanced than either “produce everything” or “produce nothing.” Attorneys who understand that nuance generally get better results than those who don’t.

The starting principle in most jurisdictions is proportionality. Discovery requests, including requests for forensic examination of a device, are generally supposed to be tailored to what’s relevant to the claims and defenses in the case—not a fishing expedition through someone’s entire digital existence.

Courts have increasingly pushed back on requests for complete forensic images of phones and computers, particularly when narrower methods can capture the relevant evidence without exposing unrelated personal material.

A request for “all text messages with this specific person during this specific time period” tends to fare much better than “give me the phone.”

After all, if someone sued you over a fender-bender, you probably wouldn’t give them your garage door opener and let them check every shelf and rag just in case they find something useful.

This is where forensic protocols come in, and they’re more sophisticated than most non-experts assume.

A forensic examination doesn’t have to mean someone reading every photo and message on a device. Searches can be scoped by date range, keyword, contact, application, file type, or a combination of all of these. Privileged or clearly irrelevant material can be filtered before opposing counsel ever sees the results.

Courts will sometimes appoint a neutral third-party examiner—someone retained by neither side—specifically to address privacy concerns. The examiner produces only responsive material under a protocol agreed upon in advance. I’ve worked within that structure many times, and it tends to satisfy both the legitimate discovery need and the legitimate privacy objection, which is no small trick. Getting two opposing attorneys to agree on anything is occasionally harder than recovering data from a damaged hard drive.

There’s also a category of information that receives special treatment regardless of relevance concerns: health information, financial account credentials, privileged attorney communications, and in some jurisdictions, location data tied to sensitive activities. Courts are generally more protective of these categories, and a request that sweeps them in without specific justification is likely to draw a motion to quash—and probably deserves to.

The practical lesson for attorneys on either side of this issue is the same: be specific.

If you’re requesting examination of a device, define the scope as narrowly as the case allows. You’ll encounter fewer objections, spend less time arguing, and generally get faster compliance.

If you’re objecting to a request, propose an alternative that addresses the actual relevance concern rather than simply saying no. “No” by itself rarely survives a motion to compel for very long. Unless of course, it’s that aforementioned teenager.

Privacy and discovery aren’t really opposites. They’re both trying to answer the same underlying question: What information is actually necessary to resolve this dispute fairly?

The cases that move most smoothly are usually the ones where both sides—and their experts—keep that question in view instead of treating discovery as an opportunity to rummage through someone’s entire digital sock drawer.

And trust me, after examining thousands of devices over the years, I can assure you that most digital sock drawers contain exactly what you’d expect: lots of clutter, a few surprises, a number of screenshots of questionable provenance whose purpose has been lost to history, and almost never the thing you were originally looking for.

So, as an attorney, where do you usually draw that line when negotiating the scope of a forensic examination?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Digital Privacy vs. Discovery: Where the Line Is Drawn appeared first on Burgess Forensics.

Smartphones are the single richest source of digital evidence in most litigation today. Text messages, call logs, photos, location history, app data, deleted files — it’s all there, sitting in a device that fits in a shirt pocket. Or in that back pocket that’s covered with bling. You’d think that because phones are so ubiquitous and so central to how people communicate, attorneys and their clients would have developed good instincts about preserving them. You would be wrong, and I say that with forty years of forensic experience and genuine affection for the legal profession.

The mistakes I see aren’t necessarily the result of bad intentions. They’re the result of people not knowing what they don’t know — which, in digi

tal forensics, turns out to be quite a lot. Here are the three that do the most damage.

Mistake One: Letting the Client Keep Using the Phone.

This one is so common that I’ve stopped being surprised by it, though I haven’t stopped being pained. The moment litigation is reasonably anticipated, a litigation hold applies to that phone. What it does not do, unfortunately, is apply itself. Unless someone explicitly tells the client to stop using the device normally, they will continue using it norma

lly — deleting old messages to free up space, backing up and syncing, downloading updates, letting apps purge their caches — all of which can overwrite the very data that might have been recoverable. The phone doesn’t know there’s a lawsuit. It’s just doing its job..

Even using the phone abnormally, that is – at all – makes potentially important changes to data that

could be responsive, and can also make otherwise recoverable data gone from the planet.

The fix is straightforward but has to happen early: tell your client, in plain language, to stop deleting anything and to bring you the phone. Not a screenshot of the phone. The phone. Best to put it into airplane mode and then turn it off immediately. We’ll get to screenshots in a moment.

Mistake Two: The Screenshot Problem.

Attorneys receive screenshots of text message conversations constantly. Clients send them because they’re easy, because they feel like evidence, and because nobody told them otherwise. The problem is that a screenshot is a photograph of information, not the information itself. It shows you what someone wants you to see, cropped to whatever boundaries they chose, dating the evidence to the very time they took the screenshot, with none of the underlying data that makes digital evidence actually useful in court.

Even worse, we regularly get PDFs of screenshots of the evidence, two steps of creation removed from the genesis of the underlying evidence.

A proper extraction of text messages from a phone includes the full conversation thread, the phone numbers associated with each contact, timestamps that can be verified against carrier records, and in many cases deleted messages that the client may not even know still exist. A screenshot gives you none of that. It also gives opposing counsel a straightforward authenticity challenge, because a screenshot can be edited in about thirty seconds by anyone with a basic photo app and an agenda. Courts are increasingly skeptical of screenshots standing alone, and rightly so. If the text messages matter to your case, get the phone examined by someone who can extract the data forensically.

Mistake Three: The Factory Reset.

This is the one that occasionally crosses the line from mistake into something courts take a very dim view of, depending on the timing and the circumstances. People factory reset their phones for all kinds of innocent reasons — selling the device, switching carriers, trying to fix a software problem, general digital housekeeping, following the instructions of a tech support rep. Even just copying the data to a new phone. Hit the wrong button during the process and Poof! All the un-transferred stuff is gone. When it happens after litigation is anticipated and a litigation hold is in effect, innocent reasons tend not to matter as much as you’d hope.

What many people don’t realize is that a factory reset, once it happens, puts you in a very difficult position legally — regardless of what may or may not remain on the device. Which, with newer devices, is usually zilch. Courts don’t look kindly on resets that occur after a litigation hold is in effect, and the explanation of ‘I didn’t know’ tends to land with a thud. The time to have this conversation with your client is before it happens, not after.”

The common thread in all three of these mistakes is timing. Digital evidence is not like paper evidence — it doesn’t just sit in a filing cabinet waiting patiently for someone to come find it. It’s dynamic, it’s fragile in ways that aren’t obvious, and the window for preserving it can close faster than anyone expects. The attorneys who understand this engage a forensic examiner early, preserve the device properly, and go into discovery knowing what the phone contains. The ones who don’t tend to find out what was on it the hard way.

If your client’s phone was examined today, would you know what’s on it — or would you find out the same time opposing counsel does?

Don’t miss a single issue of our informative newsletter … Subscribe!

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

The post The 3 Phone Mistakes That Destroy Digital Evidence Before Trial appeared first on Burgess Forensics.