Think Snapchat photos disappear immediately? Not necessarily.

A TRAGIC STORY FROM AN ACTUAL 4DISCOVERY CASE STUDY

A young driver cruising down the highway apparently did not see a truck backing out of a driveway onto the roadway in front of him. The driver (we’ll call him Tom) violently collided with the truck and was killed instantly. Why didn’t Tom see the truck? Naturally, litigation ensues and a multi-million dollar payment from the trucking company is demanded. The investigation is underway, but who is to blame?

RECOVERED SNAPCHAT SELFIES

These days, nearly every driver involved in a fatal automobile accident has a mobile phone within reach, and this case was no exception.  Could the electronically stored information contained on the Motorola XT894 Droid 4 phone recovered from Tom’s vehicle help tell the story of his fatal final moments?  As it turns out, yes.  Attorneys for the trucking company retained us to perform a court ordered examination of the device. One of our experts, Jared Sikorski, forensically recovered a series of Snapchat selfies and messages that were sent and received at the time of the accident.

In one dramatic selfie, Tom’s mirrored sunglasses clearly show him holding his phone with both hands above the steering wheel while speeding down the highway.  It is highly likely, based on the time stamp associated with the photo’s metadata, that this fateful photo was snapped just before the horrific collision with the truck that distracted Tom simply did not see. This digital evidence will, of course, play a key role in the settlement discussions.

SNAPCHAT PHOTOS DISAPPEAR IMMEDIATELY, RIGHT?

Not necessarily. A Snapchat database stored in a file location on some mobile devices can track Snapchat activity associated with the user account. The account information can be forensically recovered from the phone, even if the photos were instantly deleted by the Snapchat app after a recipient views them.

THE TAKEAWAYS

Mobile phones and other connected devices in our Internet of Things (IoT) world are becoming increasingly important containers for all types of user data. This potentially case-altering evidence should not be ignored. Here are a few tips to follow…

1.) Go for it. Remember that this data exists. If you believe the data on a device could help your case, be sure to request an examination of the device.

2.) It’s not just photos. Mobile phones collect and preserve massive amounts of user data, including GPS locations, text messages (even deleted ones), notes, and internet activity. Users are generally oblivious to this and the data can be extremely useful in a wide array of cases.

3.) Broken phone, not broken data. Keep in mind that valuable data can be recovered from even badly damaged devices. We have recovered digital evidence from phones that have been retrieved from sea water, bent in half in a car crash, and burned in a catastrophic airplane accident. If the phone’s chip is in tact, user data can often be recovered.

4.) Don’t forget the cloud. Witness claiming his dog ate his phone? No problem. A well-crafted protocol and motion can compel a defendant or other witness to produce their iCloud login credentials. Cloud-based storage services can be valuable sources of data that the witness may have forgotten were being created automatically.