Page 1
THEGOOGLEACCOUNT · A GUIDE FOR UK LAWYERS The Google Account: Android's Cloud Estate Location History, Photos, Backups and Activity: The Account That Often Knows More Than the Phone COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 35 and CrimPR Part 19. FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the account that knows more 03 What the Google account holds 04 The distinctive activity records 05 Reaching the account law full y 06 User controls, retention and honest limits 07 Deployment: the account as source and fallback 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: behind nearly every Android phone sits a Google account that holds the device's backups, photos, messages and files and, distinctively, Google's own records of the user's activity, Location History, own controls.
§ 02 · FIRST PRINCIPLES The problem in plain English: the account that knows more
§ 03 · WHATTHEACCOUNTHOLDS What the Google account holds BACKUPS PHOTOS MESSAGES / PIM DRIVE DEVICES
Page 2
§ 04 · THEACTIVITYRECORDS The distinctive activity records
§ 05 · REACHINGTHEACCOUNTLAWFULLY Reaching the account law full y
§ 06 · CONTROLS, RETENTIONANDLIMITS User controls, retention and honest limits
§ 07 · DEPLOYMENT Deployment: the account as source and fallback 19 (guides 100, 20): the account evidence deployed defensibly.
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (LOCAL/ GOOGLE ANDROID MANUFACTURER PAIRED / PROVIDER / ACCOUNT DEVICE CLOUD COUNTERPART CARRIER BACKUPS CLOUD)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESEALEDPHONEANDTHEACCOUNTTHATKNEWEVERYTHING EXAMPLE2 · THETIMELINETHATPLACEDTHEJOURNEY EXAMPLE3 · THERECORDTHATWASABSENTBYTHEUSER ' SCHOICE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Google account checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why is the Google account so important in Android matters? If the phone is locked, can the account still be reached? What is Location History, and how reliable is it? The account shows no Location History. Does that prove the person didn't travel? How is Google account data obtained law full y? Do search and browsing records prove what someone intended?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, The Google Account Androids Cloud Estate, Computer Forensics Lab, https://e-discovery.uk/library/the-google-account-androids-cloud-estate/pdf.