Geolocation Evidence

GEOLOCATIONEVIDENCE · AGUIDEFORUKLAWYERS Geolocation Evidence GPS, Wi-Fi, Cell, EXIF and App Data: Converging Sources, Honest Confidence COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE GEOLOCATION LOCATION ACCURACY & CONFIDENCE CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many sources, different reliability 03 The location sources and how they work 04 Accuracy and the confidence ladder 05 Collecting and correlating location onto a timeline 06 Convergence, contradiction and honest limits 07 Deployment: presence, alibi, movement and privacy 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: location comes from many sources of very different accuracy, GPS, Wi-Fi, cell, photo metadata, app and cloud histories, and the reliable answer comes not from one source but from making several converge on a timeline, each stated at its honest confidence rather than asserted with false precision. § 0 2 · FIRSTPRINCIPLES The problem in plain English: many sources, different reliability § 0 3 · THESOURCES The location sources and how they work GPS WI-FI CELL EXIF APP / CLOUD § 0 4 · THECONFIDENCELADDER Accuracy and the confidence ladder § 0 5 · COLLECTINGANDCORRELATING Collecting and correlating location onto a timeline § 0 6 · CONVERGENCEANDHONESTLIMITS Convergence, contradiction and honest limits § 0 7 · DEPLOYMENT Deployment: presence, alibi, movement and privacy § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives LOCATION CLOUD NETWORK VEHICLE / COUNTERPART / DELETED / SOURCE PLATFORMS OPERATOR WEARABLE CCTV RECOVERABLE DEVICE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECELLRECORDTHATWASNOTAPINPOINT EXAMPLE2 · THECONTRADICTIONTHATREVEALEDTHETRUTH EXAMPLE3 · THEPROPORTIONATESLICEOFANINTRUSIVEHISTORY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a data holder) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAGEOLOC AT IONANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The geolocation checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Which location source is the most reliable? The other side says a cell record puts our client at a specific address. Is that right? Does location data prove our client was there, or just their phone? The sources disagree. Does that ruin the evidence? Can we just get our opponent's full location history? There is no location data for the key period. Does that mean our client was not there? § 1 4 · REFERENCE Glossary EXIF Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY