Even so, as Kessler points out, data recovered from third-party servers will not be as good as evidence recovered from a forensic examination; the company can obtain only current data, not deleted files from a server's unallocated or slack (unused) space.
New technology, new devices
Cohen says that criminals have always had unique ways to hide evidence — such as wireless devices hidden inside drywall — but that as wireless technology becomes more sophisticated, storage media can be concealed up to 200 meters away without need for a repeater.
It has also become more mobile. The Eye-Fi Inc.'s wireless SD card, for instance, uses a wireless home network to upload images from a camera — or even directly from the card — to a computer or Web-based photo-sharing server.
Kessler adds that larger capacity devices packaged in smaller sizes can make it difficult for investigators to easily find. "My cell phone has a micro SD card, the size of my pinky fingernail, with four gigabytes of memory," he says. "Finding it in a seized phone is not the problem — finding it in a drawer is." So is finding the increasingly creative form factors of many thumb drives, which can be hidden inside pens, dolls, rubber "thumbs" and other toy-type enclosures.
Cohen points out that just as dashboard GPS systems show detectives what suspects have been up to — whether used for themselves or used to track another person — non-data technology can show patterns of behavior. For instance, "apps" or applications installed on iPhones or BlackBerries can show intent, or other reference points to a particular crime.
Moreover, technology advancements mean ever-shifting rules of evidence. "Search incident to arrest" of mobile devices now varies by state; it follows that courts will interpret the law in varying ways, depending on the degree of individual privacy involved — such as with GPS units. This makes it important for officers to back up their activities with search warrants or other court orders.
At the same time, however, new technology may render such issues moot. "Solid state memory devices look like a hard drive to a computer," says Kessler, "but the electronics and physics are totally different. When you delete data from a solid state memory device, it resets that portion of the drive — deleting and then rewriting the space. So unallocated and slack space are different in this type of drive than we are used to, making recovery difficult if not impossible."
It's not technical — it's police work
Because digital devices and storage media have become so widespread, investigators may wonder what they should focus on, besides a desktop or laptop computer, when executing a search warrant. This is where old-fashioned police work comes in.
The suspect's associates can often be counted on to reveal his or her habits, such as, "He always has his thumb drive with him." This can be especially crucial in cases of child pornography or intellectual property theft. Further, data recovered from devices such as in-vehicle GPS units and mobile phones can back up suspect patterns — or breaks in patterns.
Interviews can also get suspects and witnesses to reveal how to obtain evidence, especially on scene. For example, if the investigator sees an unfamiliar icon on a device, he or she can ask what it's for; if the suspect is unwilling to talk, a Google search can help.
While trained field investigators such as Indiana State Police digital evidence recovery specialists can easily handle this kind of evidence themselves, certain cases warrant involvement of a digital forensic examiner.
These include homicide, rape, and robbery; standard protocols for the seizure of digital evidence should be followed, and investigators should not take shortcuts such as "the computer guys take too long." Even if evidence can be located more quickly, the likelihood that the case will be jeopardized due to lack of following protocol remains strong.
Exceptions to this rule include exigent circumstances, especially a child's disappearance. Protocol should never override common sense, like turning the device on to try to find where the person may be.