By Peter Coons, Senior Vice President, Digital Forensics and Collections Expert, D4, LLC
You can tell a lot from a picture. This is my Facebook (FB) profile picture.
What you can tell from this picture:
1. I am a Buffalo Bills fan…sad, but true
2. I have a silver salmon in my hand (if you know your fish)
3. I am on a boat
4. There are mountains behind me
What you can’t tell from this picture:
1. Where this picture was taken (It was Alaska)
2. Who caught the fish (I did)
3. The year this picture was taken (2006)
My point is that you shouldn’t jump to conclusions. Let’s say I was suing someone for an injury suffered in an accident in 2010 and I was claiming that I couldn’t fish anymore. Well, someone may jump on my FB account and see this picture and use it as evidence that I am lying. See where I am going with this? As Ronald Reagan famously stated, “doveryai no proveryai”…Trust, but Verify!
In the past year I assisted a client with a matter that involved someone creating a fake Facebook page using my client’s name, photos of her, etc. The fake profile had her hometown identified correctly, her place of work, and her birthdate. There was no reason to think it was not her account. The perpetrator made false and inflammatory statements on the fake page in attempt to deface my client. In the end, I referred my client to the local authorities. So yes, this does happen!
In Closing
No matter what method you choose for preserving ESI from SNS, digital forensic experts urge you to remember these 7 key tips:
- Document your process (dates, times, who captured the info, etc.) This is true of any preservation and collection endeavor.
- The person that preserves, may be the person that testifies about the process.
- Know the tool or method being used and its shortcomings.
- Know what you get and don’t get by using the Facebook “Download a copy” method.
- Don’t gain access to an account illegally or through nefarious means.
- Don’t assume an account belongs to someone just because it says it does – verify it, if necessary and possible!
- Don’t assume anything about pictures, since you don’t know when they were taken! Verify it, if necessary and possible!
