Unexpected Sources of Evidence

When the average person thinks about digital evidence they think of files on a computer, emails, text messages, and photo/video evidence. In reality however, digital evidence (information and data of value to an investigation that is stored on, received, or transmitted by an electronic device) consists of so much more. Digital evidence can be found on and retrieved from almost any electronic device and an experienced digital forensic examiner can help you determine what otherwise overlooked devices may hold information relevant to your investigation.

For example:

• Smart Watches: Smart watches may store messages, location, and heart rate data. This can be useful to retrieve otherwise deleted messages, help prove an individual’s location, and help determine what state of activity that person was in.
• Fitness Bands: Fitness bands may store location, velocity, activity level, and heart rate data. This is useful when determining where a person was, what activity they were doing, and has even been used to help determine state of alarm.
• Printers: Printers may store usage and connection logs. This can help prove location at a given time.
• Televisions: Televisions may store usage and connection logs. This can help prove location at a given time.
• Gaming Consoles: Gaming consoles may store usage and connections logs. This can help prove location at a given time.
• Smart Home devices: Devices such as smart thermostats and smart doorbells may store information such as usage logs, connection logs, activity sensors, and video. This can be used to determine when a building was occupied, when it was not occupied, and who was at the door.
• Roombas: Roombas may store information regarding the size, shape, and layout of the home. This can be used to help determine the location and positioning of items in the home over time.

Technology is a powerful tool that has multiple functions. The surface value of a technical device is to make the user’s life easier and to assist with daily tasks. However underneath the surface, they can also be used to determine factors such as location, activity rate, video log, and connection logs by an experienced examiner.