Digital Evidence and Data Recovery

As digital forensic examiners at Lucid Truth Technologies, we are on the frontline of a growing constitutional quandary: applying eighteenth-century search and seizure principles to twenty-first-century data. The sheer scale of digital information fundamentally challenges the traditional application of the Fourth Amendment. Orin Kerr’s provocative book, The Digital Fourth Amendment: Privacy and Policing in Our […]

A crucial source of evidence on Windows computers that often goes overlooked is ThumbCache database forensics. As a criminal defense lawyer, you understand the weight that digital evidence carries in legal cases. These files can offer a surprising depth of information, even about files that may have been deleted. A strong defense strategy necessitates understanding

Email can be a key piece of evidence in both civil and criminal cases. Yet, as I discussed in my previous post, "Photocopied Text Messages: Don’t Be Fooled by Fabricated Evidence", presenting just the visible content of a message is fraught with risk. Fabricated or altered digital evidence can mislead and undermine your case. Email

The digital world leaves footprints, even when we try to erase them. As a lawyer, understanding how deleted files can be recovered can be a powerful tool in your courtroom arsenal. This post explores some key concepts in digital forensics, specifically: Unallocated Files: Imagine your hard drive as a library. When you delete a file,

My friend and colleague, Kevin Ripa of the Grayson Group of Companies, has published some astonishing research [1] that shows Microsoft Windows can inaccurately report the serial numbers of the drives attached to the computer system and may even report the same incorrect serial number for multiple drives. This can lead a forensic analyst to

Recently, I have been working on my estate plan. Naturally, as a forensic analyst, I have an interesting perspective after examining multiple computers and phones of those that have passed. Also, consider that important information may be kept in cloud services like Google Drive, Dropbox, MS OneDrive, etc. Dealing with the death of a loved