Examining Digital Devices: Whose data is it, anyway?

Most people have things on their phone they would rather to keep to themselves. This could be anything from an innocuous purchase at Starbucks to more sensitive information like bank accounts and private correspondence. Add location history, text messages, and call records, and that pocket-size phone can hold a thorough snapshot of your life.

This information can be compelling evidence in a dispute, and a qualified digital forensics investigator can often extract useful data. But can anyone examine another person’s phone, tablet, or computer to look for damaging information?

While digital privacy laws are far from settled, the short answer is no.  Anything you find – no matter how damaging – can be disqualified as evidence unless you have the right to access data on the device. There are multiple considerations that determine whether you have the right to view the data.

Device vs. data

Every device has an owner who purchased it or pays for the service plan. But in a dispute, the value of the device is its data… and the data is not necessarily the property of the device owner. Data is usually owned by the primary user of the device, no matter who owns the actual phone, tablet, or computer.

Think of it like a landlord tenant relationship: If you rent a house to someone, you do not have the right to enter the home without permission and search the safe in the closet.

Identifying the primary user

At Hawk PI, there are key questions we use to determine data ownership, including: Who uses the device? Is it primarily one individual? Is it a shared family device? Is the password shared among multiple users? Do you know the password? Is the device no longer in use?

What’s to stop someone from claiming to be the primary user?

Most phones, computers, and tablets provide characteristics identifying the primary user, including registrations, usernames, and the context of the data itself. If, during a forensic examination, we determine that primary user is not who we expected, we will not release the data without written permission from the rightful owner.

Business phones and computers

One notable exception to a device owner’s rights can occur when the device is owned by a business. Some businesses have a contract with the employee who will use the device, expressly stating that the business may access the data at any time. Conversely, the agreement may provide an expectation of privacy to the user, which can block an employer’s access to data.

Can data be preserved in anticipation of a court order?

If we are unable to determine ownership, or you have reason to believe important data may be destroyed before legal access can be achieved, a forensic investigator can create an “image” of the data on the device. This saves the data accessible at that moment. All information recovered is then sealed until permission is granted by the owner of the data or a court order is provided.

Ethics and Professionalism

Hawk PI is committed to the highest level of ethics and professionalism in data recovery. Our goal is to discover all data legally available in manner which ensures its admissibility as evidence.  Typically, we require written consent of the primary user or a court order before examining any device. This not only protects you or your client, but arms you with ethically obtained evidence to achieve the outcome you desire.