Page 1
GEOLOCATIONEVIDENCE · A GUIDE FOR UK LAWYERS Geolocation Evidence GPS, Wi-Fi, Cell, EXIF and App Data: Converging Sources, Honest Confidence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE GEOLOCATION LOCATION ACCURACY & CONFIDENCE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many sources, different reliability 03 The location sources and how they work 04 Accuracy and the confidence ladder 05 Collecting and correlating location onto a timeline 06 Convergence, contradiction and honest limits 07 Deployment: presence, alibi, movement and privacy 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: location comes from many sources of very different accuracy, GPS, Wi-Fi, cell, photo metadata, app and cloud histories, and the reliable answer comes not from one source but from making several converge on a timeline, each stated at its honest confidence rather than asserted with false precision.
§ 02 · FIRST PRINCIPLES The problem in plain English: many sources, different reliability
§ 03 · THE SOURCES The location sources and how they work GPS WI-FI CELL EXIF APP / CLOUD
Page 2
§ 04 · THECONFIDENCELADDER Accuracy and the confidence ladder
§ 05 · COLLECTINGANDCORRELATING Collecting and correlating location onto a timeline
§ 06 · CONVERGENCEANDHONESTLIMITS Convergence, contradiction and honest limits
§ 07 · DEPLOYMENT Deployment: presence, alibi, movement and privacy
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives LOCATION CLOUD NETWORK VEHICLE / COUNTERPART / DELETED / SOURCE PLATFORMS O PER AT OR WEARABLE CCTV RECOVERABLE DEVICE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECELLRECORDTHATWASNOTAPINPOINT EXAMPLE2 · THECONTRADICTIONTHATREVEALEDTHETRUTH EXAMPLE3 · THEPROPORTIONATESLICEOFANINTRUSIVEHISTORY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a data holder) Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAGEOLOC AT IONANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The geolocation checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Which location source is the most reliable? The other side says a cell record puts our client at a specific address. Is that right? Does location data prove our client was there, or just their phone? The sources disagree. Does that ruin the evidence? Can we just get our opponent's full location history? There is no location data for the key period. Does that mean our client was not there?
§ 14 · REFERENCE Glossary EXIF Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Geolocation Evidence, Computer Forensics Lab, https://e-discovery.uk/library/geolocation-evidence/pdf.