“Not Forensic” Doesn’t Mean “Not Reliable”: Consumer Digital Data

---

During a cross-examination, the opposing attorney tried to strike DJS’s Digital Forensic Analyst’s testimony, which featured data from Google, claiming “Google is not forensic.”  The point was not that Google data is inherently worthless, but that Google data is not generated for forensic purposes and, therefore, (he argued) it is not reliable.

This raises the question: Why is data created, and does that affect whether it can be evaluated or relied upon?

None of us were born with DNA or fingerprints “for prosecution.”  These are inherent biological traits, yet investigators and courts rely on them because there are established methods for collection and analysis, standards for interpretation, and known errors that can be tested and explained.  Consumer-generated digital data fits the same logic: the data may not be created for litigation, but forensic reliability is established by methodology, not by the platform’s marketing intent.

When it comes to digital forensics, the role of an expert witness is not to declare a platform “forensic” or “non-forensic.”  Their job is to evaluate the accuracy of the available records using accepted methods, document how the information was obtained, and explain what the data can and cannot support.  The analysis of data becomes “forensic” when an examiner applies a disciplined, repeatable process: preserving data properly, validating what can be, cross-checking against other sources, and drawing conclusions.  

The statement, “Google is not forensic,” reflects legitimate concerns: consumer systems are not designed with chain of custody in mind; retention policies can change; timestamps and location estimates have nuance; syncing can complicate “where” a record truly originated; and users can sometimes influence what gets recorded.  While all of that is true, none of it automatically makes the data unusable.  It simply means the expert must address those realities openly and conservatively.

A digital forensic analyst typically adds value in five ways:

1. Preservation and integrity controls: Documenting how the data was acquired and kept from alteration during examination.
2. Internal consistency checks: Looking for sequence logic, timestamp behavior, device settings, app behavior, and technical artifacts that support (or contradict) the story being told.
3. Corroboration across independent sources: The strongest opinions rarely rest on a single app screen.  Comparing records with device artifacts, network records, vehicle data, video, receipts, or other timelines can reinforce an expert’s opinion.
4. Plain-language limitations: Not all “location” is the same, and not all timestamps mean what laypeople assume.  A reliable expert explains limitations according to the specific context.
5. Conservative conclusions: A sound opinion matches the strength of the evidence.  If the data only supports a range, the expert says “range,” not a pinpoint. 

For the record, the opposing attorney’s motion to strike was denied and DJS’ expert’s testimony was allowed.