A series on what digital artefacts record and what they cannot automatically establish about a person.
The difference between the digital trace of a device and evidence of a particular person’s conduct. What do GPS, mobile networks, Wi-Fi, IP addresses, cloud accounts and application records actually prove?
A timestamp in a phone is not automatically the moment of the real-world event. An analytical essay on what digital systems actually record.
Between the data on a phone and a line in a forensic report stand a database, parser, normalisation, interface and human interpretation. So what exactly does the court see?
Digital forensics cannot bring back the past. Can find artifacts. What is decisive is what exactly survived — and what can no longer be honestly claimed from the find.