A series on what digital artefacts record and what they cannot automatically establish about a person.
Published parts: 4 · Last updated:
The difference between the digital trace of a device and evidence of a particular person’s conduct. What do GPS, mobile networks, Wi-Fi, IP addresses, cloud accounts and application records actually prove?
For one event, a phone may store the time of capture, recording, editing and synchronisation. Only their sequence and provenance show what a timestamp actually means.
Between the data on a phone and a line in a forensic report stand a database, parser, normalisation, interface and human interpretation. So what exactly does the court see?
Digital forensics cannot bring back the past, but it can find artifacts. What matters is exactly what survived — and what can no longer be honestly claimed from the evidence.
