Page 1

THEGOOGLEACCOUNT · A GUIDE FOR UK LAWYERS The Google Account: Android's Cloud Estate Location History, Photos, Backups and Activity: The Account That Often Knows More Than the Phone COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM 35 and CrimPR Part 19. FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the account that knows more 03 What the Google account holds 04 The distinctive activity records 05 Reaching the account law full y 06 User controls, retention and honest limits 07 Deployment: the account as source and fallback 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: behind nearly every Android phone sits a Google account that holds the device's backups, photos, messages and files and, distinctively, Google's own records of the user's activity, Location History, own controls.

§ 02 · FIRST PRINCIPLES The problem in plain English: the account that knows more

§ 03 · WHATTHEACCOUNTHOLDS What the Google account holds BACKUPS PHOTOS MESSAGES / PIM DRIVE DEVICES