Dissecting Computer, Social Media, & The Internet of Things As They Relate to Forensics

In Episode 2 of Data Discourse, Pete Mansmann and Jeff Stiegler break down changes, challenges, and evolutions in digital forensics - zeroing in on computers, social media, and the Internet of Things. They examine how advancements in technology are reshaping data collection and analysis methods. This episode provides valuable insights for how investigators can adapt to the complexities of modern digital evidence.

The discussion on social media highlights the difficulties investigators face due to the constantly-updating of platforms and strict privacy settings. With new applications like TikTok and WhatsApp becoming prevalent, traditional methods of collecting comprehensive social media histories are no longer feasible. 

Instead, investigators now need to conduct targeted searches and rely on data from mobile devices to understand a subject's social media interactions more effectively.

The episode also covers the impact of the Internet of Things. Devices such as smart home assistants and security cameras can offer critical information for your case, but accessing this data can be challenging due to legal and technical barriers. 

Pete and Jeff spend time emphasizing the need for proper legal channels, such as subpoenas, to retrieve information from companies like Amazon, highlighting the increasing role of the Internet of Things in shaping forensic investigations.

Key Topics Covered

• Challenges in Social Media Forensics: The evolving landscape of social media platforms and the difficulty in accessing comprehensive data due to privacy restrictions.
• Targeted Data Collection: The shift towards targeted searches and the use of mobile device data to understand social media engagement.
• Role of Internet of Things Devices: How everyday Internet of Things devices like smart assistants and security cameras contribute valuable data points in investigations.
• Legal and Technical Barriers: The challenges of retrieving data from Internet of Things devices and the necessity of legal authorization for accessing information.
• Changing Forensic Methods: Adapting forensic techniques to handle the complexities introduced by new technologies and platforms.
• Future of Digital Forensics: The growing importance of incorporating Internet of Things data and social media insights into comprehensive forensic investigations.

Precise is your trusted resource for all things mobile forensics and e-discovery.

Precise is your trusted resource for all things mobile forensics and e-discovery. We look forward to partnering with your firm and helping you win your next case!

Visit our website to learn more and set up a free consultation:
Click here to get started

Or call us at 866-721-5378

Transcript

Welcome everybody to episode 2 of Data Discourse where we discuss practical advice and insights about digital forensics and E discovery. I am here with Jeff Stiegler, Director of Computer and Digital Forensics at Precise Discovery LLC. My name is Peter Mansmann and today we're going to be talking about computers, social media, and the Internet of Things. That one's very scary, the Internet of Things. So Jeff, as you may know from episode one, is the director of computer forensics, again at PRECISE. He's had many years dealing with all kinds of different devices and mobile phones to computers, to tablets to name it, to both collect devices, to analyze devices, to investigate them, to report upon them, to give opinions on devices. So we're very happy to have him here today to talk about these subjects that are very important for lawyers to understand when they're dealing with any of these issues. 

So again, today's episode, we're going to break it into three parts, computers, social media and the Internet of Things. So episode one, we really focused on mobile forensics, which clearly is a big piece of most cases that you see today. But we don't want to forget about computers. We'll talk a little bit about how computers and tablets may operate a little bit differently. I know there's some crossover between computers and tablets and phones and tablets, but I will get to that and explain a few differences and I think it would help to have a background on computers 1st and some of the things to consider with that. So, Jeff, we had talked previously about, you know, cell phones being a big piece of most investigations, but computers, computers are still a critical and important part of, of what we do. So let's talk a little bit. First question for you generally is, when you're, when you're seeing computers nowadays, or how often are you seeing computers nowadays? Like what? What typically are the kinds of devices that you're asked to interact with? I think the recent trend, you know, piggybacking on your previous discussion about the popularity of mobile devices, the recent trends kind of shows that, you know, computer devices are becoming a little less common in scenarios where they are, you know, present. 

It's a little bit different than it was in the old days. And when I say old days, I'm kind of referring to, you know, almost like pre COVID era, you know, the, the remote work thing, really, you go through a wrench and how companies handle remote work, the issuing of devices, the issuing of, you know, what we now refer to as virtual desktops, you know, where someone can log into their work computer from essentially anywhere where they are now. So computer data isn't just limited to computers these days. It also spills over into, you know, remote remote services, remote access services, cloud services and things like that. 

So expanding upon that a little bit, would it be fair to say that you're not going to typically find, you know, emails on a computer or laptop, for instance, it's probably sitting on an Office 365 environment or a Gmail cloud account. I mean, I know there are times when email still can be kept locally, but are you more often seeing them out there in the cloud and connected through some provider like that versus on an actual computer? I think that's the other trend you're seeing. You know, part of it is because companies are implementing, you know, hey, log into your email through this specific portal, don't go installing Outlook, you know, wherever you want to. So you're seeing kind of the sources of some of these, this electronic data almost consolidate into some of these server and cloud areas. Whereas before, I mean, a typical user would have a work computer and maybe a laptop they travel with maybe a home desktop. They may use, you know, to work once in a while. You're not converting, you know, three or four physical devices into, you know, maybe one or two accounts or devices. 

I I think that's what we're seeing these days in these trends. So would that line up with the idea that the computers that people may be using remotely from home, which is clearly a bigger thing now than it was five years ago, Would you say that that the their use of those devices is more along the lines of a Internet portal than it is a sort of stand alone machine doing a lot of its own processing or or file generation? Yeah, to some extent. The other thing too is these mobile devices, you know, it's easier to sit on the couch and play on the Internet on your phone rather than walking across the room and grabbing your big bulky laptop or things like that. So I, I think you're actually seeing, you know, these home devices being used as nothing more than a portal to maybe a, a work computer or, you know, left for very specific tasks like booking airline tickets or online shopping, You know, things that may be a little easier to do on a computer then, you know, a small screen. But, but in general, you know, people's people's actions are occurring more on your mobile devices or things that occur in, you know, cloud services or in under corporate environments. 

And, and so when we, when we think about that, if we say, all right, well, the way people are using their computers, particularly at home, I think an office environment with traditional network setup is still a little bit different. But let's say it's a laptop that somebody's using at home or remotely, etcetera. Does that kind of change the things you're typically asked to be looking for on, on that computer at this point? Are the requests that you're seeing today as related to a computer analysis more different than they were, again, say, five years ago? I, I, I, I think that we've probably seen a shift more into user activity on computers versus necessarily files, but I wanted to see if that lines up with your experience. 

I think particularly in, you know, say I, you know, a category like employment law, you know, where a former employee may be in possession of something they shouldn't be, whether it was purposeful or not. You know, the, the question isn't usually, you know, we can very easily, easily answer, is it on there or not. The second question is how did it get on there? And sometimes how to get on there can answer what was the person intending to do with it? Or, you know, hey, did I have this client list, you know, from my former employees sitting in my Dropbox folder like I was ready to share it with someone else? Was it sitting in like an email out box? So I, I think the questions more these days aren't just lended to a what are you seeing? But you know, why are you seeing it or how did it come to this document? Forensics is it's always tricky because we're kind of relying on what the computer again, what the computers are willing to, you know, give us. And again, there's not a easy green button I can hit that says, hey, show me everything that happened with these document from the moment it was created. 

So we're looking at it now. No, you're left with looking at various trails of bread crumbs. Did it show up in a recently accessed list here? Was it modified on this date? You really have to put all these little artifacts together to, you know, tell the true story about a file, which I think is what a lot of people are interested in. These days and so, whether you're interested in understanding what happened to a file or understanding what happened on this computer, what were some of these activities or their intentions whenever they were on this computer. Talk about the importance of a proper collection and what and what that means from a forensic standpoint and which allows you to reasonably report on information contained on that computer. So missing scenarios. When we collect a computer, we're collecting, you know, every single bit of data on the hard drive. 

You're not even just the the C drive that you might see when you open up the computer. Essentially we're striping out all those ones and zeros and putting it back together. You know, encryption is going to play a deal in that these days. You know, computers by default are now coming out encrypted. So, you know, there's times when we need to rely on, you know, IT departments to help us, you know, circumvent that. 

So, so going to the importance of, you know, collecting data, you know, the, the first thing you want to do is, you know, verify that your collection is, is correct. That can be done, you know, on site by, you know, hashing the collection. 

But to that extent too, we're not just collecting, you know, the files and folders that you might see by looking at the computer. You know, we're also grabbing some of this potentially deleted area, some of the unallocated area, that space that the computer hasn't given up to you to use, though it may be using it in the background. Again, though, you're seeing similar to, you know, mobile forensics is that the recovery of deleted data is becoming much, much more difficult with computers as well, mostly because of just a change in general policies, but also the technology itself. You know, hard drives being made these days aren't anything similar to the hard drives that were made ten years ago and they behave vastly differently specifically with regards to overwriting deleted data. So as we are seeing this trend moving towards, you know, the questions tend to be who did what when on a computer? How important is it that you get a proper forensic collection of the device versus you knowing what somebody might be able to see if they're looking on a computer and browsing through directories? Is it? Is it critical to make sure this is done properly at the beginning? I'll tell you from personal experience, having spent, you know, 20 some years and, you know, just IT support, it would be very difficult to sit down and go through a computer. 

To the extent that, you know, to some of the things we can do as analysts. Both because of the, you know, the software that we have, but also the additional expertise of, you know, learning about how these operating systems work, learning about where data resides, you know, before it even exists on the disks, things like that. It would be, yeah, equivalent to, you know, going back to, you know, if you look at an iceberg, you only see what's above the water. I mean, a full forensic exam is going to, you know, get everything. And, you know, I think we can use employment cases as a good example, sort of walking through some of these things that you're looking for on computers or potentially analyzing. 

But let's break these down into some examples and, and employment cases. Again, we see a lot of them just because of the The Who did what and when on a computer is, is often at what issue in that case. So talking about that Internet history, when have you seen that come into play? How far back can you typically go to find Internet history on a computer? How can you tell who Internet history is potentially related to? And when have you seen that come, you know, into value, maybe using an employment case as an example? So again, that's something that's, you know, constantly changing. I think now you're seeing a brand new computer. You, you know, install a browser, set it up, and by default, it's only going to keep your Internet history for 30 or 60 days. The second one is, you know, it may not even be storing these Internet history databases on the computer. If I'm a Chrome user and I sign in with my Google account, it's actually syncing that with my Google account, Google account in the cloud. 

So in that case, you know, it's more beneficial to an examiner to look at the Google account rather than the computer itself. So you're seeing some of these data sources that used to reside on the computer now existing in other places. And are you seeing more and more instances where either privacy settings are turned on or people are using a private browser where it's just not keeping any of that information? I think people are becoming more aware. You know, I'm even seeing some users use third party browsers, you know, besides Safari or Chrome or Firefox that you know, you've not heard of that, you know, specifically offer, you know, fully encrypted web browsing and things like that. And, you know, the amount of Internet history, you know, web browsing history available for some of these third party apps is almost non-existent. They almost truly are, you know, anonymized, you know, in the field of, you know, employment law, you know, regarding some of this, I think the biggest request is, you know, proper usage of computer systems. 

You know, was someone doing something on a computer that they shouldn't have been? And, you know, there's been scenarios where, you know, even though you're running a private browser, you know, we maybe can't determine, you know, when you went to a website, but at some point something made a record of you visiting, you know, this single website or a string of websites that we use to prove, you know, inappropriate use. 

And, talking about that employment scenario and the potential that you may have, we may have the question about where files improperly taken were information or evidence taken that shouldn't have been from an employer to an employee moving to a new place. Talk about that where somebody comes to you and says, hey, this is this is the issue. 

We had the top salesmen just left and we think they're going to join a competitor or we think that they're going to start out on their own. And we think they took this critical client list with them, that is, confidential information they shouldn't have. And they say, here's their computer. 

This is the one that was assigned to them. This is the one that they've had since the time they're with the company. We want to understand what may have happened, you know, in the days, weeks leading up to their leaving. Talk about just generally, what are some things that you would typically be looking for to find evidence that you know may show something happened? I'd say more often than not, what gets people into some of these scenarios are flash drives. Specifically the scenario of, hey, this was my last day. 

I have some pictures on my computer. I just copied my documents folder to my flash drive and thought nothing of it. And then weeks later get served, you know, with a subpoena saying, hey, you took client data. You go into this flash drive and see they've not only copied their family pictures, but they copied, you know, client list, things like that, You know, whether it was just negligence or, you know, done purposefully. I may not be asked, you know, to make an opinion on that. But what we're looking for are typically with employment law and things like that, you know, an intellectual property, the concern is where did this data make its way to? So we're looking at outbound, you know, e-mail, particularly personal email. Hey, did I log into a Gmail account on my personal Gmail account on a company computer on my last day and forward myself a bunch of files? Did I connect the flash drive, you know, on the morning of my last day of employment? Did I set up your Dropbox or any other file sharing service, you know, some, some other method of getting these files to myself? Those are typically where we start with because if you see, you know, if you start to see artifacts or files in these, it's a pretty good trail to follow. 

Who, who were these sent to? Which account were these? Do we need to now collect these accounts and see what happened? You really start, you know, like I said, I always refer to the trail of breadcrumbs, but it starts somewhere and you never find everything you need in one place. In this industry. You need to really combine various sources, databases and whatnot to really get the whole picture. And let's say you find evidence that a flash drive or thumb drive was connected, you know, at 4:30 on the last day of someone leaving at 5:00. 

Are you able to match that up if later on you have thumb drives that somebody had in their possession to show that it is this thumb drive or what's the limitations? How far can you go with identifying where that thumb drive may have gone or, or matching it to one later identified? Yeah. So whenever a flash drive is plugged into a computer, a limited set of of data is, you know, retrieved again, depends on the device plugged in, but you may have a matching serial number or just the fact that, you know, I have a, a folder named, you know, AD drive and a folder named Jeff. You know, it's a good indication that, you know, I'm copying files to do places like this. So sometimes you have to get a little simple, you know, it's not always about carving up databases and finding, you know, it's more about thinking about how the average user would behave. And I expect the average user to, you know, drag and drop files to copy things via those methods other than, you know, methods that might, you know, obfuscate or be a little more, you know, forensically friendly to put it in, in some manner. 

You know, we're, we're obviously still looking for these, but you know, it kind of helps to, you know, to know what the average computer user is capable of and, you know, put themselves in your shoes and, you know. It might make sense of why, you know, something might reside where it does or you know why you're seeing data that you're seeing. 

So, I'm in a lap on my laptop. I came into my office today to record this podcast and my laptop automatically connected to the Wi-Fi because it recognizes it as a trusted Wi-Fi source. Is that information kept on this computer somewhere? Would it be in three months from now, would I be able to go back and say, hey, I can show this computer connected to this Wi-Fi at this time? Again, variables 3 months are cutting it right on that cusp of the standard 306090 day. You know, the history of the automatic deletions you're seeing these days with regards to now without knowing, you know, what operating system you're running. I would expect to see, you know, the Wi-Fi name the first time you connected to it and probably the last time you successfully connected to it, but not necessarily every connection in between. But it's important. And that's what puts the emphasis on the sooner you collect a device after you think there might be something there, preserve it, the better it is that you're preserving information in that time period that's going to be valuable to you. 

Yes, I mean, some of these, you know, computer artifacts are the, the new, brand new Windows computers do not audit user logins by default. 

It's their claim that it takes up too much space. But so that's an audit. What do you mean by that? I'm just keeping track of successful logins. And you know, who logged in successfully, whether it was a password, whether it was a biometric scan, fingerprint face scan, you know, these things would be very, very useful in determining, hey, who is using a computer at some point. But nowadays, you know, some of these devices aren't even recording that by default. You know, these are things that IT departments need to be turning on and after the fact it is always too late. You can never go back and you know, turn something on and recover, you know, from the past. It just doesn't work that day. So there's becoming more and more roadblocks too and recovering some of this data. 

Now the last area I want to touch base on computer wise today because it's something that we've all heard and I don't think it is necessarily true and you touch base on this. But I remember, you know, growing up or I guess by the time computers were used, I wasn't so young anymore in the way they were used today. But regardless that I remember being told, hey, just because you delete something doesn't mean it's deleted. 

It's going to live there forever. And I think, I think in times past that was a lot more true than it is today. Can you touch base on deleted files and accessibility and what that means? And, you know, how can you recover deleted files and to what extent? Yeah, I'm trying to put this, you know, the simplest technical terms. The way data used to behave was if I wanted to delete a file on my computer, basically I was telling my computer, if you need the space in the future, go ahead and use it. 

I've given you that permission. So over time, what you end up is, you know, a full hard drive may be full of some snippets of files that were deleted, but not overwritten. Nowadays, these devices themselves, I mean, they're not platter spinning based anymore. 

They're just physical chips. And these chips are designed to make themselves last longer. Actually, it's more beneficial for them to delete data, you know, more readily. When I say, hey, delete data, I don't mean mark this area as unused. 

I mean right over it immediately. So your, your window of, you know, deletion, you're recovering deleted data with it used to be months, maybe years is now hours, maybe minutes. And sometimes you throw an encryption on top of that. And you know, if encrypted files are deleted, more often than not that encryption key is deleted and it's gone, it is gone for good. And that's true of modern computers. If you had something that's been sitting around for years, you may have accessibility to a higher level than you do today. But as those get phased out, I think it's fair to say that accessing deleted files, you know, after any period of time is going to become more and more difficult. Yeah, we're definitely seeing it less and less on a practicality basis. Yes, OK. 

Well, that's our basic topics on computers. You know, there's a whole other area that can be talked about when you're talking about servers and you know, networking and other things like that. 

We're not going to get into today. I do though, before we completely leave that subject, just touch base very briefly on the differences between pads, you know, iPads and and other devices like that and your typical computer, you know, what is it or how should you consider dealing with devices like that versus a computer? So tablets are becoming more and more popular. You kind of break, I can kind of break them down into three categories. I mean, you have your iPads, your Android tablets, and then you are kind of your third party, most common being like an Amazon, you know, Kindle kind of ordeal. 

An iPad is essentially an iPhone. It's structured the same way. Its data extraction is the same way. iPad forensics falls under mobile forensics, the same limitations and expectations. And more often than not, what you're seeing people use their iPads for is I let my kids play games on them. I do my accounting, I do some shopping, browsing, productivity, not so much. You know, I may be reviewing some documents, but I, you know, I, I'm trying to recall a scenario where someone says they were drafting spreadsheets or, you know, things on, on an iPad. 

You just don't see it too much. Android tablets kind of fall under the same way where some of them behave like Android phones and some of them behave more like standard computers and the third party tab like the tablets, the Kindles and stuff. 

There's very little extractable information on these devices. Most of it's out on some cloud account anyways. You don't, they don't get involved too much. You know, we've, I've touched them for, you know, the sake of, you know, doing a complete collection of, you know, everyone's someone's all devices, but you don't see a lot of activity that's, you know, productive. 

Off those devices. Great. All right, we're going to move on to social media and social media as a term could mean so many different things nowadays. And you know, it used to be that, you know, when you said social media, you knew you had to check someone's Facebook and maybe LinkedIn and you know, Instagram. There weren't that many that you needed to worry about in order to go see what somebody was saying online and some type of, you know, social application has changed today. You know, it's very difficult to be able to identify everything that somebody might be using. There isn't some magic search button that you can push out there and say, find me everything on the Internet. 

That doesn't stop people from asking us. I'm sure you've run across the same thing I have where somebody said, Hey, I need you to download all this person's social media profiles, postings, all that kind of stuff. That's if they're particularly if you don't know, hey, I'm just talking about one application and they're a limited user that's next to impossible task. 

But I wanted to kind of talk through some of the things to consider with social media understanding again, new apps and new ways of, of, of communicating and people interacting on these things are happening every single day. 

We wouldn't have been talking about TikTok three years ago. WhatsApp wasn't something that was on anybody's radar, you know, four or five years ago. So it's always changing. And, and what becomes in vogue and what becomes something that's heavily used is, is always going to be sort of a moving target. 

But some things to consider about social media. You talked briefly about public versus private settings. Yeah, I'll use Facebook as an example, but it's called the platform that people are most familiar with. But you know, in most of these platforms, you know, I can create an account and I can pick and choose who I want to have access to. You know, some platforms we need to be friends or we need to be following each other for you to see my posts. Some of them you can set to everyone seeing everything. 

I don't care. So sometimes there's requests where, hey, we need, you know, person XS, you know, social media accounts and have to go back and say. I can show you their profile page. I can't get any further because I'm not friends with them, you know, and in some scenarios it's OK, We'll, we'll get you the kind of someone that is friends with them or, you know, hey, we'll go about, you know, requesting the data from their side. 

A lot of these social media sites are now offering methods of getting your own data out much better than they were in the past, almost to the point where it's the same methodology that examiners like myself use for examining, say, an Instagram account. You know, we'll, we'll pull data from your phone and see what we can find. We'll log into the account and see what we can find. But we'll also submit a request. It's not a subpoena. It's just a formal data request through Instagram, you know, from the account that can encompass, you know, more data than you would see on the actual live site. So, you know, there are more avenues, but I think you're also seeing a little bit of a pushback and against social media in general, you know, the constant checking in, updating people where you are. People are kind of migrating to, you know, sites where that's not necessarily the, you know, the crux of the content. It's, you know, it, it, it's changing. 

It's especially with young people these days. You know, my social media engagements with teenagers, you know, six years ago is much different than what they're doing now. I mean, half of them don't even have Facebook accounts anymore. 

It, it's, it's so it's constantly changing. I'm always trying to keep up with what the kids are doing as well as, you know, what it, what the, what the adults are doing, who's, who's using what, you know, what service for, you know, what kind of content these days? And so going back to trying to identify where do you even look? I would imagine that that puts more emphasis on potentially looking at someone's phone. 

You know, a lot of these applications from my explosion experience, and maybe you've seen the same thing are going to be driven or used by some through someone's phone. Whether they're taking videos or texting something off quickly or posting something very quickly usually is done from a mobile device. So, you know, you want to know what somebody's using to kind of get the road map as to what the look into deeper a phone I think is an important source to to give you that sort of understanding at the beginning. Yeah, I mean social media is also a great resource for location information. Again, it's what the user is willing to, you know, input. But in this scenario, you know, you still have people, you know, checking into events, you know, so and so's retirement party at XY and Z bar at this date and time. So there is, you know, a lot of information that can be gathered. The question is sometimes can we see it? And these platforms, specifically Facebook have blocked any third party software from accessing Facebook sites. 

That means, you know, I used to have social media software that can go out and, you know, just scrape your entire timeline. 

That's not possible anymore. Facebook blocks all that you are seeing from some, some, you know, companies that specifically offer that service. Hey, we'll, we'll go out and kind of do some Pi work to see where accounts may exist and collect things to the extent that we can. But oftentimes as an examiner, I mean, I'm, I'm, I'm as limited to what you see as a, as a lawyer would see if someone has their account locked down, it's locked down and then and, and going to it, let's say you can't access this stuff. 

It's not locked down. The longevity of how long this information stays up there. Again, I'll go back to my earlier comment of us being told, oh, when you delete something, it's never truly deleted. 

It's out there forever. We've also been told once you post something out there on the Internet, it never goes away. I think there's been a trend towards a lot of these applications that don't keep data for very long. 

They're very transitory. So something's in, something's out. There aren't any historical postings now, others are different. 

Do you have a sense of if you know, are some applications more likely to have a long history of everybody's activity on that and others are very short? I think Facebook, the big ones are the big and old school ones, Facebook, Instagram, Twitter, they, they still leave it up to the user. I mean, it'll, it'll remain there until and at any moment in time you can say delete. Now as far as when you say delete and the, you know, capability of recovering that it probably falls closer to the recovery of text message content. 

You have maybe two weeks to subpoena that company and get that data back. You know, normally I'm not involved in things within two weeks. So you know to some extent delete really does mean delete these days, even with online posts and you touched base, the check insurance can be a great source of location information. So if someone's saying, hey, you know, I'm tagging so and so that we're at the same party or location or whatever together, oftentimes that's coming with some type of geolocation information saying you are here, you're at this location or otherwise. So it is, if that's something that's critical in a case, is something for people to consider that social media may be worth investigating deeper for those purposes alone. 

I think one of the things that we've seen in our time of doing this, as you mentioned, there used to be softwares out there you could connect to various social media platforms. And once you identify the user, you could basically go in and say download everything off of this, you know, user's connection. And if it was public, then the software could download it essentially into a big PDF file for you. 

I think practically speaking, that that that's kind of gone by the wayside for two reasons #1 is that there's so many different applications popping up all the time that it would be next to impossible for them to keep up. You know, with the software development to make all those connections #2 is people are more conscious about public versus private settings, as are these applications. So they are not making it easy for something to make a connection that in turn I think has sort of developed a business model and industry around some companies out there that specialize in social media investigations. And we've worked with several of them over the years. And there are a lot of great options that are out there. But just to give a flavor for what they typically do, rather than just saying I'm going to go collect all this stuff and give it to you because it can be a vast, vast amount of stuff that's not very sortable or searchable. 

They're giving instructions and more like a digital Private Eye. They're going to go out and say, all right, well, tell me what's important in your case? Are you looking for bad behavior? Are you looking for postings about certain events? Are you looking for postings about certain people? What is it that you're trying to find? They will then go out and do the research on these individuals themselves and come back and report to you in a concise way. 

Here's what we found that we think meets your criteria. Is this important or not? Do we need to dig into this further? Is there more to be done here? I think that makes a lot more sense for a lot of these social media searches because otherwise you're just drowning in information. 

Yeah. I mean, I mean, a lot of times too, it's just with proper authorization, it's easier to collect the information from the account itself. I know it's not always possible, but that's really the best way to make sure you're getting as much data as you can. 

Yeah. All right, so social media, again, a couple bullet points just to make sure we cover that. Oftentimes a great way to figure out what social media people are involved with, if at all, is looking at their phone, the apps installed, the access, the different social media sites on there can often tell you how active they are or not. And that, you know, really I just asking for downloads of people's social media sites may not be the way to go. It just may be so much information that you aren't able to do much with it. 

So our next and last topic is the Internet of Things. So, Jeff, can you tell us just generally speaking, when someone says Internet of Things, what are they talking about? Anything that you have connected to you know, be it a doorbell, your refrigerator, your, your TV. These days if you see smart devices, that device claiming to be smart or anything that you know classify as the Internet of Things necessarily you know. 

Things you devices you won't necessarily think could have, you know, store useful data, but you'd be surprised sometimes what they're capable of. 

Yeah. And, and, and this sort of all goes to the convenience of having all these interconnected devices that can do all these kinds of things and make our lives convenient, etcetera. They're also creating potential data points and not everyone is valuable, but it gets you thinking. If you're, if you're in that spot where you, you need to find some critical pieces of information or make sure they're not out there, you have to expand your thinking a little bit to say, all right, well, well, what else is out there that may have something that tells us something important about what happened. So I just want to touch base on some common devices out there. 

A lot of this is kind of new in terms of where you would potentially analyze and do things. And this is another area where stuff is changing so quickly. But you know, we have a lot of people that have a Lexus and series and Google Homes now, you know, little, little devices that you can talk to and ask them to play music or ask them questions and different things like that. Number one, have you been asked to engage much in dealing with these types of devices yet at this point in time? They've come up in conversations, but I don't think it's ever evolved to the point where, hey, we should look at it. 

Like I said it is going into, you know, the Alexas. And so I know I won't make comments on whether or not they're listening to you actively or recording your conversations or whatnot. But you know, that information would not be extractable by any means from an Alexa, maybe through a subpoena through Amazon, you know, Google, you know, something like that is more likely where I can see, you know, Internet of Things, you know, investigations being more applicable. Maybe, you know, like I said, a blue, a dumb Bluetooth device like an ATV that hasn't been set up. You know, if you wanted to prove that so and so was on premises that, you know, this place. OK, well, why do they? Why does the Bluetooth TV you know show up as an interconnected device? A Nest doorbell? You know, fridge, refrigerators, you know, things like that. Any, any Bluetooth connection is essentially in some, you know, one way or another, a check in similar to a social media check in. 

You know, you might not get, you know, as much information as you would from a social media check in, but it's a data point and it should be considered. And, you know, you're seeing more and more of video security systems. I mean, they're cheap, whether it's a blank or a ring or any of a number of other options that are out there can be set up to be recording multiple places and, and, you know, take snapshots of activity and sound. 

You can communicate through them. And, and sometimes that information is kept for a certain period of time on, on someone's account. So there's all these different places where you have data. I find the whole Alexa Siri question interesting because you know, if you have Siri set up on your iPhone, for instance, and you say you know, Siri does XYZ, it suddenly pops up. How can it do that? I think Apple has said, well, no, it's not recording you. It is analyzing the sounds in the room to determine whether or not a command's been made, which sounds a lot to me like recording. But I know there were issues about this early on. I think it was with an Alexa case where there was a murder and Alexa, they subpoenaed Amazon to get recordings And I, they did find that there were recordings from that room where they were able to pick up conversations and things like that. And it wasn't based upon a command. 

Remember Me reading about a case with that and, and Amazon's automatic response to it was, but we don't keep any of these recordings. They're just, they're just there for a limited period of time to, you know, both improve our ability to understand when commands are made. 

But it's a big question mark. Are there recordings out there from these devices? I, I've always found it amazing where you're talking to somebody and your phone's in proximity and you go home and the next thing you know, whatever you were talking about is suddenly showing up and ads on your, your, your phone, which always made raise my suspicions of is it understanding what's being said? Again, a little conspiratorial element to that, but it is a question as to whether or not some of those things are doing it. Smartwatches, people are texting through smartwatches now the more that people are dictating into their phones to do responses and things like that, it's just more interconnected devices that are moving data back and forth that are containing things that are potentially important. 

Something I think is interesting is online gaming. There's a lot of, you know, my kids spend a lot of time on online gaming and most of the time they're, they're talking through their devices and things like that. But you know, there is some texting that goes on back and forth. There's another data point to show this username is logged on to this point in time, which is connected to this IP address at this house. 

It's location information. And for a lot of this stuff, that's kind of what it comes down to. It's like, all right, well, for you to have entered this house, you had to enter the security code. Who knows the security code or for you to have Bluetooth turned on the lights in your room, it recognized this device within Bluetooth range of, of the capabilities of doing that, which would then lead to the conclusion that somebody was nearby. So this Internet of Things is more to sort of just put the topic out there of saying we're going to have to think broader and broader as these become more and more prevalent in our everyday lives. One last area to talk about an Internet of Things because I think we'll see this more often as in vehicles, we've probably all heard the I think who is an Allstate has the drive wise app that lets you say, all right, well, if you install this safe driver rewards, what's that mean? It means that it's tracking. Are you hard braking? Are you speeding? Are you driving erratically? Are you doing all these different things? Life's 365 app has something very similar where you know you can install it for instance, on your kids phone who's driving to see, are they driving safely or not? And these applications are basically tracking what's happening with that phone device, when someone's moving through a vehicle and even these vehicles themselves. 

There are so many electronics in them in terms of capabilities there, there are many computers themselves at this point. The potential resource of data coming from those black boxes for breaking scenarios and you know, when headlights are turned on all that type of stuff. 

There's a lot of information that's captured in these vehicles that sort of falls under this Internet of Things. But the point on that whole category again is just that you really need to be thinking broader at this point when it comes to that stuff because there's potential other data sources out there you may not be aware of at the moment. So this concludes episode two of our Data Discourse podcast, again covering computer, social media, Internet of Things. 

I'll return with Jeff again for episode 3 with our Digital Forensics storytelling podcast, where we're going to talk about some interesting cases in the news and interesting cases that we've worked on. But we thank everybody for joining us again, if you ever have any questions, please feel free to reach out to us directly. 

We look forward to working with you on a future case and thank you for listening. Thank you.